feat: publish verifiable proxyctl v1

scripts/test-release.sh

@@ -0,0 +1,33 @@
+#!/bin/sh
+set -eu
+
+repo=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT HUP INT TERM
+
+VERSION=v1.0.0 "$repo/scripts/build-release.sh" "$work/first"
+VERSION=v1.0.0 "$repo/scripts/build-release.sh" "$work/second"
+
+for arch in amd64 arm64; do
+  binary="proxyctl-linux-$arch"
+  test -x "$work/first/$binary"
+  cmp "$work/first/$binary" "$work/second/$binary"
+done
+cmp "$work/first/SHA256SUMS" "$work/second/SHA256SUMS"
+(
+  cd "$work/first"
+  sha256sum -c SHA256SUMS
+)
+
+amd64_format=$(file -b "$work/first/proxyctl-linux-amd64")
+arm64_format=$(file -b "$work/first/proxyctl-linux-arm64")
+printf '%s\n' "$amd64_format" | grep -Eq 'ELF 64-bit.*(x86-64|x86_64)'
+printf '%s\n' "$arm64_format" | grep -Eq 'ELF 64-bit.*(ARM aarch64|aarch64)'
+
+# Only execute the binary matching the build host; format checks cover both.
+case $(go env GOARCH) in
+  amd64) test "$($work/first/proxyctl-linux-amd64 version --short)" = v1.0.0 ;;
+  arm64) test "$($work/first/proxyctl-linux-arm64 version --short)" = v1.0.0 ;;
+esac
+
+printf 'amd64: %s\narm64: %s\nrelease automation is reproducible and checksums verify\n' "$amd64_format" "$arm64_format"