vcspath=$2
modname=$3
version=$4
+signkey=$5
dst=$modname/@v
mkdir -p $dst
unzip -p $version.zip ${modname}@${version}/go.mod > $version.mod
printf '{"Version":"%s","Time":"%s","Origin":{"VCS":"git","URL":"%s","Ref":"refs/tags/%s","Hash":"%s"}}' \
$version $when $vcsurl $version $hsh > $version.info
-touch -d $when $version.info $version.mod $version.zip $version.ziphash
+totouch=($version.info $version.mod $version.zip $version.ziphash)
+[[ -z $signkey ]] || {
+ ssh-keygen -Y sign -f $signkey -n file $version.ziphash
+ totouch=($totouch $version.ziphash.sig)
+}
+touch -d $when $totouch