svn commit: r1035515 - in /websites/staging/httpd/trunk/content: ./ dev/verification.html

[bu...@apache.org]

Author: buildbot
Date: Fri Sep 21 17:30:16 2018
New Revision: 1035515

Log:
Staging update by buildbot for httpd

Modified:
    websites/staging/httpd/trunk/content/   (props changed)
    websites/staging/httpd/trunk/content/dev/verification.html

Propchange: websites/staging/httpd/trunk/content/
------------------------------------------------------------------------------
--- cms:source-revision (original)
+++ cms:source-revision Fri Sep 21 17:30:16 2018
@@ -1 +1 @@
-1841076
+1841620

Modified: websites/staging/httpd/trunk/content/dev/verification.html
==============================================================================
--- websites/staging/httpd/trunk/content/dev/verification.html (original)
+++ websites/staging/httpd/trunk/content/dev/verification.html Fri Sep 21 17:30:16 2018
@@ -111,9 +111,9 @@ h2:hover > .headerlink, h3:hover > .head
 h2:hover > .headerlink, h3:hover > .headerlink, h1:hover > .headerlink, h6:hover > .headerlink, h4:hover > .headerlink, h5:hover > .headerlink, dt:hover > .elementid-permalink { visibility: visible }</style>
 <h1 id="verifying-apache-http-server-releases">Verifying Apache HTTP Server Releases<a class="headerlink" href="#verifying-apache-http-server-releases" title="Permanent link">&para;</a></h1>
 <p>All official releases of code distributed by the Apache HTTP Server Project
-are signed by the release manager for the release. PGP signatures and MD5
+are signed by the release manager for the release. PGP signatures and SHA
 hashes are available along with the distribution.</p>
-<p>You should download the PGP signatures and MD5 hashes directly from the
+<p>You should download the PGP signatures and SHA hashes directly from the
 Apache Software Foundation rather than our mirrors. This is to help ensure
 the integrity of the signature files. However, you are encouraged to
 download the releases from our mirrors. (Our download page points you at
@@ -249,6 +249,29 @@ verifying the signature of a release.</p
 <span class="n">gpg</span><span class="p">:</span>                 <span class="n">aka</span> &quot;<span class="n">Jim</span> <span class="n">Jagielski</span> <span class="o">&lt;</span><span class="n">jim</span><span class="p">@</span><span class="n">jaguNET</span><span class="p">.</span><span class="n">com</span><span class="o">&gt;</span>&quot;
 <span class="n">gpg</span><span class="p">:</span>                 <span class="n">aka</span> &quot;<span class="n">Jim</span> <span class="n">Jagielski</span> <span class="o">&lt;</span><span class="n">jimjag</span><span class="p">@</span><span class="n">gmail</span><span class="p">.</span><span class="n">com</span><span class="o">&gt;</span>&quot;
 </pre></div>
+
+
+<p>In order to check the integrity of the downloaded file, you need to download the source and the related SHA256
+hash. For example, assuming a preference for tar.bz, to verify the 2.4.34 release you should end up with two files on disk:</p>
+<ul>
+<li>httpd-2.4.34.tar.bz2 (source)</li>
+<li>httpd-2.4.34.tar.bz2.sha256 (SHA256 hash)</li>
+</ul>
+<p>On most Unix systems then it is only a matter of executing: </p>
+<div class="codehilite"><pre><span class="c">% shasum -a 256 -c httpd-2.4.34.tar.bz2.sha256</span>
+<span class="n">httpd</span><span class="o">-</span>2<span class="p">.</span>4<span class="p">.</span>34<span class="p">.</span><span class="n">tar</span><span class="p">.</span><span class="n">bz2</span><span class="p">:</span> <span class="n">OK</span>
+</pre></div>
+
+
+<p>Behind the scenes, the command checks that the SHA hash contained in httpd-2.4.34.tar.bz2.sha256 matches the one
+calculated for the file httpd-2.4.34.tar.bz2. The correct result should be a 'OK' displayed.</p>
+<p>Another way to calculate the SHA256 has for a file is to use openssl:</p>
+<div class="codehilite"><pre><span class="c">% openssl sha -sha256 httpd-2.4.34.tar.bz2</span>
+<span class="n">SHA256</span><span class="p">(</span><span class="n">httpd</span><span class="o">-</span>2<span class="p">.</span>4<span class="p">.</span>34<span class="p">.</span><span class="n">tar</span><span class="p">.</span><span class="n">bz2</span><span class="p">)=</span> <span class="n">fa53c95631febb08a9de41fd2864cfff815cf62d9306723ab0d4b8d7aa1638f0</span>
+</pre></div>
+
+
+<p>And then verify that the content of httpd-2.4.34.tar.bz2.sha256 matches the above result.</p>
             
 
             <!-- FOOTER -->