Add readme example and some TODOs

On the advice of shellcheck

readme.txt

@@ -2,6 +2,44 @@ This simple script takes a file as an argument and prompts the user for a messag
 
 To verify that your message applies to the file they recieved, your recipient(s) would verify your signature of the script, and then run it (or merely inspect it if they don't trust you too much) which will confirm their file matches the one you wrote the message about.
 
+Example:
+
+I have a file foo.txt, so I run ():
+
+`create-file-message.sh webpage.htm`
+
+When prompted, enter the message to associate with the file.
+
+Then sign the resulting webpage.htm.sh file
+
+`gpg --sign webpage.htm.sh`
+
+You will then have the following files which should be distributed together:
+
+* webpage.htm
+* webpage.htm.sh
+* webpage.htm.sh.sig
+
+Whoever wants to validate the file and the message will first import your public key, then they validate webpage.htm`
+
+When prompted, enter the message to associate with the file.
+
+Then sign the resulting webpage.htm.sh file
+
+`gpg --sign webpage.htm.sh`
+
+You will then have the following files which should be distributed together:
+
+* webpage.htm
+* webpage.htm.sh
+* webpage.htm.sh.sig
+
+Whoever wants to validate the file and the message will first import your public key, then they verify the script file with `gpg --verify webpage.htm.sh`, finally they run `./webpage.htm.sh` which will check whether the target file matches the stored hash and if so will display the message.
+
+TODO: example of making it a function in your profile
+
+TODO: guix package
+
 Motivation:
 
 Signing a file typically means "I authored this", but sometimes you want to sign something else, for example to indicate that you retrieved something on a given date.

verify-script.template

@@ -1,11 +1,11 @@
-#! /bin/bash
+#!/bin/env sh
 
 MESSAGE="{message}"
 FILE="{filename}"
 EXPECTED_HASH="{filehash}"
 
 if [ "$(sha256sum "$FILE" | awk '{print $1}')" = "$EXPECTED_HASH" ]; then
-	printf "File $FILE validated with message:\n$MESSAGE"
+	printf "File %%s validated with message:\\n%%s" "$FILE" "$MESSAGE"
 	exit 0
 else
 	echo "File $FILE is not valid"