A software vendor distributes a tarball named app-2.4.tar.gz to customers. You need to publish a signature file so customers can verify the tarball's integrity and authenticity separately, without altering or bundling the original archive. Which command produces the correct artifact?