X-Git-Url: http://www.git.cypherpunks.ru/?a=blobdiff_plain;f=doc%2Fintegrity.texi;h=5547ef9bc90cf89111ef0cb29ca8400af5963e36;hb=7058f97373b95cb0e19b48a424d95fc850614da8;hp=67edc7240558ce8b92fe475e2af418ebd8f6fab5;hpb=2a5c56d7ba8cecf8f200255d5e5c61589c43009c;p=nncp.git diff --git a/doc/integrity.texi b/doc/integrity.texi index 67edc72..5547ef9 100644 --- a/doc/integrity.texi +++ b/doc/integrity.texi @@ -1,11 +1,17 @@ @node Integrity +@cindex integrity check +@cindex authenticity check +@cindex OpenPGP +@cindex gpg +@cindex GnuPG +@cindex WKD @section Tarballs integrity check You @strong{have to} check downloaded archives integrity and verify their signature to be sure that you have got trusted, untampered software. For integrity and authentication of downloaded binaries -@url{https://www.gnupg.org/, The GNU Privacy Guard} is used. You must -download signature (@file{.sig}) provided with the tarball. +@url{https://www.gnupg.org/, GNU Privacy Guard} is used. You must +download signature (@file{.asc}) provided with the tarball. For the very first time you need to import signing public key. It is provided below, but it is better to check alternative resources with it. @@ -19,19 +25,18 @@ uid NNCP releases @itemize @item -@verbatim -% gpg --keyserver hkp://keys.gnupg.net/ --recv-keys 0x2B25868E75A1A953 -% gpg --auto-key-locate dane --locate-keys releases at nncpgo dot org -% gpg --auto-key-locate wkd --locate-keys releases at nncpgo dot org -% gpg --auto-key-locate pka --locate-keys releases at nncpgo dot org -@end verbatim +@example +$ gpg --auto-key-locate dane --locate-keys releases at nncpgo dot org +$ gpg --auto-key-locate wkd --locate-keys releases at nncpgo dot org +@end example @item -@verbatiminclude .well-known/openpgpkey/hu/i4cdqgcarfjdjnba6y4jnf498asg8c6p.asc +@verbatiminclude .well-known/openpgpkey/nncpgo.org/hu/i4cdqgcarfjdjnba6y4jnf498asg8c6p.asc @end itemize Then you could verify tarballs signature: -@verbatim -% gpg --verify nncp-3.1.tar.xz.sig nncp-3.1.tar.xz -@end verbatim + +@example +$ gpg --verify nncp-@value{VERSION}.tar.xz.asc nncp-@value{VERSION}.tar.xz +@end example