From: Sergey Matveev Date: Sat, 14 Dec 2019 21:34:08 +0000 (+0300) Subject: Autogenerate INSTALL X-Git-Tag: v2.3.0~2 X-Git-Url: http://www.git.cypherpunks.ru/?p=gocheese.git;a=commitdiff_plain;h=348eb9427e27321ed8b82dd5e8c80b17e9108425 Autogenerate INSTALL --- diff --git a/INSTALL b/INSTALL deleted file mode 100644 index 0b69a6c..0000000 --- a/INSTALL +++ /dev/null @@ -1,28 +0,0 @@ -Preferable way is to download tarball with the signature from -website and, for example, run tests with benchmarks: - -@verbatim -$ [fetch|wget] http://gocheese.cypherpunks.ru/gocheese-2.2.0.tar.xz -$ [fetch|wget] http://gocheese.cypherpunks.ru/gocheese-2.2.0.tar.xz.sig -$ gpg --verify gocheese-2.2.0.tar.xz.sig gocheese-2.2.0.tar.xz -$ xz -d < gocheese-2.2.0.tar.xz | tar xf - -$ make -C gocheese-2.2.0 all test -@end verbatim - - -You have to verify downloaded tarballs integrity and authenticity to be -sure that you retrieved trusted and untampered software. GNU Privacy -Guard is used for that purpose. - -For the very first time it is necessary to get signing public key and -import it. It is provided below, but you should check alternative -resources. - - pub rsa2048/0xCD5CD01F55343D88 2019-12-08 [SC] - 9B27640BA78437EC6D4ACA6CCD5CD01F55343D88 - uid GoCheese releases - - Look in PUBKEY.asc file. - - $ gpg --auto-key-locate dane --locate-keys gocheese at cypherpunks dot ru - $ gpg --auto-key-locate wkd --locate-keys gocheese at cypherpunks dot ru diff --git a/Makefile b/Makefile index 3fdfbd4..d88c7e6 100644 --- a/Makefile +++ b/Makefile @@ -12,7 +12,7 @@ all: gocheese gocheese.info gocheese: GOPATH=$(GOPATH) go build -o gocheese -ldflags "$(LDFLAGS)" $(MOD) -gocheese.info: gocheese.texi +gocheese.info: *.texi $(MAKEINFO) -o $@ gocheese.texi test: diff --git a/download.texi b/download.texi index a1f31e2..de64c9f 100644 --- a/download.texi +++ b/download.texi @@ -1,17 +1,3 @@ -@node Download -@unnumbered Download - -Preferable way is to download tarball with the signature from -website and, for example, run tests with benchmarks: - -@verbatim -$ [fetch|wget] http://gocheese.cypherpunks.ru/gocheese-2.2.0.tar.xz -$ [fetch|wget] http://gocheese.cypherpunks.ru/gocheese-2.2.0.tar.xz.sig -$ gpg --verify gocheese-2.2.0.tar.xz.sig gocheese-2.2.0.tar.xz -$ xz -d < gocheese-2.2.0.tar.xz | tar xf - -$ make -C gocheese-2.2.0 all test -@end verbatim - @multitable {XXXXX} {XXXX-XX-XX} {XXXX KiB} {link sign} {xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx} @headitem Version @tab Date @tab Size @tab Tarball @tab SHA256 checksum @@ -20,34 +6,3 @@ $ make -C gocheese-2.2.0 all test @tab @code{5AA24DA6 C03C51BD 5C45CD50 AA1F19B5 6360C892 3ED86F06 D0F2B8FA 4C8CCB5B} @end multitable - -You @strong{have to} verify downloaded tarballs integrity and -authenticity to be sure that you retrieved trusted and untampered -software. @url{https://www.gnupg.org/, GNU Privacy Guard} is used -for that purpose. - -For the very first time it is necessary to get signing public key and -import it. It is provided below, but you should check alternative -resources. - -@verbatim -pub rsa2048/0xCD5CD01F55343D88 2019-12-08 [SC] - 9B27640BA78437EC6D4ACA6CCD5CD01F55343D88 -uid GoCheese releases -@end verbatim - -@itemize - -@item -@verbatim -$ gpg --auto-key-locate dane --locate-keys gocheese at cypherpunks dot ru -$ gpg --auto-key-locate wkd --locate-keys gocheese at cypherpunks dot ru -@end verbatim - -@item -@verbatiminclude PUBKEY.asc - -@end itemize - -You can obtain development source code with -@command{git clone git://git.cypherpunks.ru/gocheese.git}. diff --git a/gocheese.texi b/gocheese.texi index 626c0e3..8372394 100644 --- a/gocheese.texi +++ b/gocheese.texi @@ -22,6 +22,19 @@ It serves two purposes: @url{https://warehouse.pypa.io/api-reference/legacy/, Warehouse Legacy API} @end itemize +Why could you like it and how it can be better to fit your needs? + +@itemize +@item No database required. Only filesystem storage with few simple + files per package. Package deletion, renaming, making it uploadable + (private) is done with simple @command{mkdir}, @command{touch}, etc + commands +@item Just single statically compiled Go binary +@item No configuration file, but several simple command line arguments +@item Consistency (because of atomic synced operations) and integrity + (because of SHA256 checksums stored nearby) +@end itemize + Initially it was created as a fork of @url{https://github.com/c4s4/cheeseshop, cheeseshop}, but nearly all the code was rewritten. It has huge differences: @@ -53,24 +66,24 @@ Please send questions, bug reports and patches to @url{gocheese@@cypherpunks.ru} @insertcopying @menu -* Download:: +* Install:: * Usage:: * Password authentication: Passwords. * TLS support: TLS. * Storage format: Storage. @end menu -@include download.texi +@include install.texi @node Usage @unnumbered Usage To use it for download purposes, just configure your @file{pip.conf}: -@verbatim +@example [install] index-url = http://gocheese.host:8080/simple/ -@end verbatim +@end example @option{-refresh} URL (@code{/simple/} by default) automatically refreshes metainformation (available versions and their checksums) @@ -83,21 +96,21 @@ package files. You can upload packages to it with @url{https://pypi.org/project/twine/, twine}: -@verbatim +@example twine upload --repository-url http://gocheese.host:8080/simple/ \ --username spam \ --password foo dist/tarball.tar.gz -@end verbatim +@end example Or you can store it permanently in @file{.pypirc}: -@verbatim +@example [pypi] repository: https://gocheese.host/simple/ username: spam password: foo -@end verbatim +@end example If @command{twine} sends SHA256 checksum in the request, then uploaded file is checked against it. @@ -113,9 +126,9 @@ Password authentication is required for packages uploading. You have to store your authentication data in @option{-passwd} file in following format: -@verbatim +@example username:hashed-password -@end verbatim +@end example Empty lines and having @verb{|#|} at the beginning are skipped. @@ -140,13 +153,14 @@ foo:$argon2i$v=19$m=32768,t=3,p=4$OGU5MTM3YjVlYzQwZjhkZA$rVn53v6Ckpf7WH0676ZQLr9 @item SHA256 You can use your operating system tools: -@verbatim +@example # BSD-based systems: $ echo -n "password" | sha256 # GNU/Linux-based systems $ echo -n "password" | sha256sum -@end verbatim +@end example + Example user @code{foo} with password @code{bar} will have the following password file entry: @@ -158,10 +172,10 @@ foo:$sha256$fcde2b2edba56bf408601fb721fe9b5c338d10ee429ea04fae5511b68fbf8fb9 You can refresh passwords by sending @code{SIGHUP} signal to the working daemon: -@verbatim +@example $ pkill -HUP gocheese $ kill -HUP `pidof gocheese` -@end verbatim +@end example Before refreshing it's recommended to check @option{-passwd} file with @option{-passwd-check} option to prevent daemon failure. @@ -175,7 +189,7 @@ negotiation, Keep-Alives, modern ciphersuites and ECC. For example generate some self-signed certificate using GnuTLS toolset: -@verbatim +@example $ certtool --generate-privkey --ecc --outfile prv.pem $ cert_template=`mktemp` $ echo cn=gocheese.host > $cert_template @@ -186,7 +200,7 @@ $ certtool \ --outfile=cert.pem $ rm $cert_template $ gocheese -tls-cert cert.pem -tls-key prv.pem [...] -@end verbatim +@end example @node Storage @unnumbered Storage format diff --git a/install.texi b/install.texi new file mode 100644 index 0000000..94a12f5 --- /dev/null +++ b/install.texi @@ -0,0 +1,48 @@ +@node Install +@unnumbered Install + +@set VERSION 2.2.0 + +Preferable way is to download tarball with the signature from +website and, for example, run tests with benchmarks: + +@example +$ [fetch|wget] http://gocheese.cypherpunks.ru/gocheese-@value{VERSION}.tar.xz +$ [fetch|wget] http://gocheese.cypherpunks.ru/gocheese-@value{VERSION}.tar.xz.sig +$ gpg --verify gocheese-@value{VERSION}.tar.xz.sig gocheese-@value{VERSION}.tar.xz +$ xz -d < gocheese-@value{VERSION}.tar.xz | tar xf - +$ make -C gocheese-@value{VERSION} all test +@end example + +@include download.texi + +You @strong{have to} verify downloaded tarballs integrity and +authenticity to be sure that you retrieved trusted and untampered +software. @url{https://www.gnupg.org/, GNU Privacy Guard} is used +for that purpose. + +For the very first time it is necessary to get signing public key and +import it. It is provided below, but you should check alternative +resources. + +@verbatim +pub rsa2048/0xCD5CD01F55343D88 2019-12-08 [SC] + 9B27 640B A784 37EC 6D4A CA6C CD5C D01F 5534 3D88 +uid GoCheese releases +@end verbatim + +@itemize + +@item +@example +$ gpg --auto-key-locate dane --locate-keys gocheese at cypherpunks dot ru +$ gpg --auto-key-locate wkd --locate-keys gocheese at cypherpunks dot ru +@end example + +@item +@verbatiminclude PUBKEY.asc + +@end itemize + +You can obtain development source code with +@command{git clone git://git.cypherpunks.ru/gocheese.git}. diff --git a/makedist.sh b/makedist.sh index af5b918..5fc3d19 100755 --- a/makedist.sh +++ b/makedist.sh @@ -65,14 +65,24 @@ rm -fr src/golang.org $tmp/includes mv $tmp/golang.org src cat > download.texi < $texi <