1 You @strong{have to} verify downloaded tarballs authenticity to be sure
2 that you retrieved trusted and untampered software. There are two options:
6 @item @url{https://www.openpgp.org/, OpenPGP} @file{.asc} signature
7 Use @url{https://www.gnupg.org/, GNU Privacy Guard} free software
9 For the very first time it is necessary to get signing public key and
10 import it. It is provided @url{PUBKEY-PGP.asc, here}, but you should
11 check alternate resources.
14 pub ed25519/0x3A528DDE952C7E93 2021-01-09
15 7531BB84FAF0BF35960C63B93A528DDE952C7E93
16 uid goredo releases <goredo@cypherpunks.ru>
20 $ gpg --auto-key-locate dane --locate-keys goredo at cypherpunks dot ru
21 $ gpg --auto-key-locate wkd --locate-keys goredo at cypherpunks dot ru
24 @item @url{https://www.openssh.com/, OpenSSH} @file{.sig} signature
25 @url{PUBKEY-SSH.pub, Public key} and its OpenPGP
26 @url{PUBKEY-SSH.pub.asc, signature} made with the key above.
27 Its fingerprint: @code{SHA256:ddOaswnUBtNbuoEBYQtfcF59sR3Bvzo9pIfSlw9sKx8}.
30 $ ssh-keygen -Y verify -f PUBKEY-SSH.pub -I goredo@@cypherpunks.ru -n file \
31 -s goredo-@value{VERSION}.tar.zst.sig < goredo-@value{VERSION}.tar.zst