Dealing with GPG signatures

[gocheese.git] / gocheese.texi

diff --git a/gocheese.texi b/gocheese.texi
index f89df36221c40070d6bc5e360c3af7fc28042170..17bcbedfdcd98fb03a86243e74f4d1c93df75466 100644 (file)
--- a/gocheese.texi
+++ b/gocheese.texi
@@ -10,11 +10,12 @@ GoCheese is Python private package repository and caching proxy.
 It serves two purposes:
 
 @itemize
-@item hosting of private locally uploaded packages (conforming to
-    @url{https://www.python.org/dev/peps/pep-0503/, PEP-0503} (Simple
-    Repository API))
 @item proxying and caching of missing packages from upstream
-    @url{https://pypi.org/, PyPI}
+    @url{https://pypi.org/, PyPI}, conforming to
+    @url{https://www.python.org/dev/peps/pep-0503/, PEP-0503}
+    (Simple Repository API)
+@item hosting of private locally uploaded packages, conforming to
+    @url{https://warehouse.pypa.io/api-reference/legacy/, Warehouse Legacy API}
 @end itemize
 
 Initially it was created as a fork of
@@ -22,21 +23,28 @@ Initially it was created as a fork of
 but nearly all the code was rewritten. It has huge differences:
 
 @itemize
-@item proxying and caching of missing packages
+@item proxying and caching of missing packages, including GPG signatures
 @item atomic packages store on filesystem
-@item SHA256-checksummed packages (both uploaded and proxied one)
-@item no TLS support
+@item SHA256-checksummed packages: storing checksums, giving them back,
+    verifying stored files integrity, verifying checksum of uploaded
+    packaged
+@item graceful HTTP-server shutdown
 @item no YAML configuration, just command-line arguments
-@item no package overwriting ability
+@item no package overwriting ability (as PyPI does)
 @end itemize
 
+Also it contains @file{pyshop2packages.sh} migration script for
+converting @url{https://pypi.org/project/pyshop/, Pyshop} database into
+GoCheese one, including private packages.
+
 GoCheese is free software, licenced under
-@url{https://www.gnu.org/licenses/gpl-3.0.html, GNU GPLv3} conditions:
+@url{https://www.gnu.org/licenses/gpl-3.0.html, GNU GPLv3}:
 see the file COPYING for copying conditions.
 
 @menu
 * Usage::
 * Password authentication: Passwords.
+* TLS support: TLS.
 * Storage format: Storage.
 @end menu
 
@@ -61,9 +69,16 @@ You can upload packages to it with
 twine upload
     --repository-url http://gocheese.host:8080/simple/ \
     --username spam \
-    --passwd foo dist/tarball.tar.gz
+    --password foo dist/tarball.tar.gz
 @end verbatim
 
+If @command{twine} sends SHA256 checksum in the request, then uploaded
+file is checked against it.
+
+@option{-gpgupdate} is useful mainly for migrated from Pyshop
+repositories. It forces GPG signature files downloading for all existing
+package files.
+
 @node Passwords
 @unnumbered Password authentication
 
@@ -124,6 +139,28 @@ $ kill -HUP `pidof gocheese`
 Before refreshing it's recommended to check @option{-passwd} file with
 @option{-passwd-check} option to prevent daemon failure.
 
+@node TLS
+@unnumbered TLS support
+
+You can enable TLS support by specifying PEM-encoded X.509 certificate
+and private key files. Go's TLS implementation supports TLS 1.3, HTTP/2
+negotiation, Keep-Alives, modern ciphersuites and ECC.
+
+For example generate some self-signed certificate using GnuTLS toolset:
+
+@verbatim
+$ certtool --generate-privkey --ecc --outfile prv.pem
+$ cert_template=`mktemp`
+$ echo cn=gocheese.host > $cert_template
+$ certtool \
+    --generate-self-signed \
+    --load-privkey=prv.pem \
+    --template $cert_template \
+    --outfile=cert.pem
+$ rm $cert_template
+$ gocheese -tls-cert cert.pem -tls-key prv.pem [...]
+@end verbatim
+
 @node Storage
 @unnumbered Storage format