You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@uima.apache.org by tw...@apache.org on 2007/01/24 19:01:23 UTC
svn commit: r499505 - in /incubator/uima/site/trunk/uima-website:
docs/downloads.html xdocs/downloads.xml
Author: twgoetz
Date: Wed Jan 24 10:01:22 2007
New Revision: 499505
URL: http://svn.apache.org/viewvc?view=rev&rev=499505
Log:
Jira UIMA-224: part 2: distribution verification for users. Not quite done yet.
https://issues.apache.org/jira/browse/UIMA-224
Modified:
incubator/uima/site/trunk/uima-website/docs/downloads.html
incubator/uima/site/trunk/uima-website/xdocs/downloads.xml
Modified: incubator/uima/site/trunk/uima-website/docs/downloads.html
URL: http://svn.apache.org/viewvc/incubator/uima/site/trunk/uima-website/docs/downloads.html?view=diff&rev=499505&r1=499504&r2=499505
==============================================================================
--- incubator/uima/site/trunk/uima-website/docs/downloads.html (original)
+++ incubator/uima/site/trunk/uima-website/docs/downloads.html Wed Jan 24 10:01:22 2007
@@ -148,7 +148,7 @@
<tr><td>
<blockquote>
<p>
- Under construction (November 2006)
+ First release planned for the second half of 2/2007!
<!--
A release of UIMA includes the First artifact
and the Second artifact. The release is distributed as
@@ -198,6 +198,82 @@
<p>
No previous official releases are available.
</p>
+ </blockquote>
+ </td></tr>
+ <tr><td><br/></td></tr>
+ </table>
+ </blockquote>
+ </p>
+ </td></tr>
+ <tr><td><br/></td></tr>
+ </table>
+
+ <table border="0" cellspacing="0" cellpadding="2" width="100%">
+ <tr><td bgcolor="#726982">
+ <font color="#ffffff" face="arial,helvetica,sanserif">
+ <a name="Verifying a Release Download"><strong>Verifying a Release Download</strong></a>
+ </font>
+ </td></tr>
+ <tr><td>
+ <blockquote>
+ <table border="0" cellspacing="0" cellpadding="2" width="100%">
+ <tr><td bgcolor="#9289A2">
+ <font color="#ffffff" face="arial,helvetica,sanserif">
+ <a name="Signature Files"><strong>Signature Files</strong></a>
+ </font>
+ </td></tr>
+ <tr><td>
+ <blockquote>
+ <p>
+ You may be wondering what those <code>.asc</code>, <code>.md5</code> and <code>.sha1</code> files
+ on the download pages are good for. They are signature files that let you verify the integrity
+ and origin of the distribution artifacts (zip files, compressed archives) that you have downloaded.
+ The signatures come in two varieties. The <code>.md5</code> and <code>.sha1</code> files contain
+ MD5 and SHA1 checksums, respectively. The main purpose of those files is to let you verify the
+ integrity of your release artifact. You can use a tool to generate the same kind of checksum and
+ check that it's the same checksum as the one you downloaded. If the checksums agree, you can be sure
+ that your archive did not get corrupted during transmission.
+ </p>
+ <p>
+ The <code>.asc</code> files are so-called detached, ASCII-armored PGP signatures. They let you do
+ the same thing as the MD5 and SHA1 signatures, but they let you do something in addition: you can
+ use these signatures to verify that the release artifacts were signed by a certain, trusted source.
+ The <code>.asc</code> files contain checksums that were encrypted with the private PGP key of the
+ release manager responsible for the release. This is useful if you received the release files from
+ some arbitrary source, and you would like to be sure that what you have there is really a UIMA
+ release (and not something containing a virus, for example). You can then download the corresponding
+ public key from a trusted source, and use it to verify not only the integrity of the file, but that
+ it is actually the file the release manager signed in the first place. Anybody can tamper with
+ a released file and create a new checksum, but they can't fake the <code>.asc</code> file so it
+ will work with the public key of the release manager.
+ </p>
+ <p>
+ If you would like to verify your UIMA distribution or not is up to you. The next section will
+ tell you how can use each type of signature file.
+ </p>
+ </blockquote>
+ </td></tr>
+ <tr><td><br/></td></tr>
+ </table>
+ <table border="0" cellspacing="0" cellpadding="2" width="100%">
+ <tr><td bgcolor="#9289A2">
+ <font color="#ffffff" face="arial,helvetica,sanserif">
+ <a name="Using GnuPG to Verify Release Files"><strong>Using GnuPG to Verify Release Files</strong></a>
+ </font>
+ </td></tr>
+ <tr><td>
+ <blockquote>
+ <p>
+ Start by downloading and installing <a href="http://www.gnupg.org/download/">GnuPG</a>, an
+ implementation of <a href="http://openpgp.org/">OpenPGP</a>. There are many tools for verifying
+ MD5 and SHA1 checksums, here's the gpg way for MD5:
+ <blockquote> <code>gpg --print-md MD5 <ReleaseFile></code> </blockquote>
+ and for SHA1:
+ <blockquote> <code>gpg --print-md MD5 <ReleaseFile></code> </blockquote>
+ You can simply compare the resulting checksum to the one contained in the <code><ReleaseFile>.md5</code>
+ or <code><ReleaseFile>.sha1</code> checksum file. Use diff or your eyes, the signatures are short.
+ </p>
+ <p>To be continued...</p>
</blockquote>
</td></tr>
<tr><td><br/></td></tr>
Modified: incubator/uima/site/trunk/uima-website/xdocs/downloads.xml
URL: http://svn.apache.org/viewvc/incubator/uima/site/trunk/uima-website/xdocs/downloads.xml?view=diff&rev=499505&r1=499504&r2=499505
==============================================================================
--- incubator/uima/site/trunk/uima-website/xdocs/downloads.xml (original)
+++ incubator/uima/site/trunk/uima-website/xdocs/downloads.xml Wed Jan 24 10:01:22 2007
@@ -29,7 +29,7 @@
<section name="Downloads">
<p>
- Under construction (November 2006)
+ First release planned for the second half of 2/2007!
<!--
A release of UIMA includes the First artifact
and the Second artifact. The release is distributed as
@@ -66,6 +66,62 @@
</subsection>
</section>
+
+<section name="Verifying a Release Download">
+
+<subsection name="Signature Files">
+ <p>
+ You may be wondering what those <code>.asc</code>, <code>.md5</code> and <code>.sha1</code> files
+ on the download pages are good for. They are signature files that let you verify the integrity
+ and origin of the distribution artifacts (zip files, compressed archives) that you have downloaded.
+ The signatures come in two varieties. The <code>.md5</code> and <code>.sha1</code> files contain
+ MD5 and SHA1 checksums, respectively. The main purpose of those files is to let you verify the
+ integrity of your release artifact. You can use a tool to generate the same kind of checksum and
+ check that it's the same checksum as the one you downloaded. If the checksums agree, you can be sure
+ that your archive did not get corrupted during transmission.
+ </p>
+
+ <p>
+ The <code>.asc</code> files are so-called detached, ASCII-armored PGP signatures. They let you do
+ the same thing as the MD5 and SHA1 signatures, but they let you do something in addition: you can
+ use these signatures to verify that the release artifacts were signed by a certain, trusted source.
+ The <code>.asc</code> files contain checksums that were encrypted with the private PGP key of the
+ release manager responsible for the release. This is useful if you received the release files from
+ some arbitrary source, and you would like to be sure that what you have there is really a UIMA
+ release (and not something containing a virus, for example). You can then download the corresponding
+ public key from a trusted source, and use it to verify not only the integrity of the file, but that
+ it is actually the file the release manager signed in the first place. Anybody can tamper with
+ a released file and create a new checksum, but they can't fake the <code>.asc</code> file so it
+ will work with the public key of the release manager.
+ </p>
+
+ <p>
+ If you would like to verify your UIMA distribution or not is up to you. The next section will
+ tell you how can use each type of signature file.
+ </p>
+
+</subsection>
+
+<subsection name="Using GnuPG to Verify Release Files">
+
+ <p>
+ Start by downloading and installing <a href="http://www.gnupg.org/download/">GnuPG</a>, an
+ implementation of <a href="http://openpgp.org/">OpenPGP</a>. There are many tools for verifying
+ MD5 and SHA1 checksums, here's the gpg way for MD5:
+ <blockquote> <code>gpg --print-md MD5 <ReleaseFile></code> </blockquote>
+ and for SHA1:
+ <blockquote> <code>gpg --print-md MD5 <ReleaseFile></code> </blockquote>
+ You can simply compare the resulting checksum to the one contained in the <code><ReleaseFile>.md5</code>
+ or <code><ReleaseFile>.sha1</code> checksum file. Use diff or your eyes, the signatures are short.
+ </p>
+
+ <p>To be continued...</p>
+
+
+</subsection>
+
+</section>
+
</body>
</document>