You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pekko.apache.org by fa...@apache.org on 2024/03/16 10:54:46 UTC
(incubator-pekko-site) branch verification created (now 48082b83)
This is an automated email from the ASF dual-hosted git repository.
fanningpj pushed a change to branch verification
in repository https://gitbox.apache.org/repos/asf/incubator-pekko-site.git
at 48082b83 Update verification section in download.md
This branch includes the following new commits:
new 48082b83 Update verification section in download.md
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pekko.apache.org
For additional commands, e-mail: commits-help@pekko.apache.org
(incubator-pekko-site) 01/01: Update verification section in download.md
Posted by fa...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
fanningpj pushed a commit to branch verification
in repository https://gitbox.apache.org/repos/asf/incubator-pekko-site.git
commit 48082b830464709d62db8acf71a6a5d3c10766b9
Author: PJ Fanning <pj...@users.noreply.github.com>
AuthorDate: Sat Mar 16 11:54:38 2024 +0100
Update verification section in download.md
---
src/main/paradox/download.md | 41 +++++++++++++++++++++++++++++++++++++----
1 file changed, 37 insertions(+), 4 deletions(-)
diff --git a/src/main/paradox/download.md b/src/main/paradox/download.md
index bf2fafb0..5607945a 100644
--- a/src/main/paradox/download.md
+++ b/src/main/paradox/download.md
@@ -78,10 +78,18 @@ are named after the files they relate to but have `.sha512` extensions.
We also provide PGP signature files that can be verified using PGP or GPG. These files
are named after the files they relate to but have `.asc`.
-To verify the SHA digests, use:
+### Verifying Checksums
+
+To verify the SHA digests, you need the `.tgz` and its associated `.tgz.sha512` file. An example command:
+```
+sha512sum -c apache-pekko-sbt-paradox-1.0.1-incubating-src-20240305.tgz.sha512
+```
+
+Returns:
```
-find . -name "*.sha512" -type f -execdir sha512sum -c {} \;
+apache-pekko-sbt-paradox-1.0.1-incubating-src-20240305.tgz: OK
```
+### Verifying Signatures
To verify the PGP signatures, you will need to get the KEYS file. This will be in the source archive
or can be fetched from https://downloads.apache.org/incubator/pekko/KEYS.
@@ -90,7 +98,32 @@ or can be fetched from https://downloads.apache.org/incubator/pekko/KEYS.
gpg --import KEYS
```
-To verify the download files, run:
+To verify the SHA digests, you need the `.tgz` and its associated `.tgz.asc` file. An example command:
+```
+gpg --verify apache-pekko-sbt-paradox-1.0.1-incubating-src-20240305.tgz.asc
+```
+or
+```
+gpg --verify apache-pekko-sbt-paradox-1.0.1-incubating-src-20240305.tgz.asc apache-pekko-sbt-paradox-1.0.1-incubating-src-20240305.tgz
+```
+
+Returns:
+```
+gpg: assuming signed data in 'apache-pekko-sbt-paradox-1.0.1-incubating-src-20240305.tgz'
+gpg: Signature made Tue 5 Mar 11:36:27 2024 CET
+gpg: using RSA key 3FD458B4420059F1F97C2563F6A21ED3A05F7F7B
+gpg: Good signature from "Matthew de Detrich (CODE SIGNING KEY) <md...@apache.org>" [unknown]
+gpg: WARNING: This key is not certified with a trusted signature!
+gpg: There is no indication that the signature belongs to the owner.
+Primary key fingerprint: 3FD4 58B4 4200 59F1 F97C 2563 F6A2 1ED3 A05F 7F7B
+```
+You should also verify the key using a command like:
+
```
-find . -name "*.asc" -exec gpg --no-secmem-warning --verify {} \;
+% gpg --fingerprint 3FD458B4420059F1F97C2563F6A21ED3A05F7F7B
+pub rsa4096 2023-06-16 [SC]
+ 3FD4 58B4 4200 59F1 F97C 2563 F6A2 1ED3 A05F 7F7B
+uid [ unknown] Matthew de Detrich (CODE SIGNING KEY) <md...@apache.org>
+sub rsa4096 2023-06-16 [E]
+sub rsa4096 2023-06-16 [A]
```
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pekko.apache.org
For additional commands, e-mail: commits-help@pekko.apache.org