svn commit: r1024383 - /websites/production/logging/content/chainsaw/2.0.0/download.html

[ma...@apache.org]

Author: mattsicker
Date: Fri Jan 26 19:17:08 2018
New Revision: 1024383

Log:
Clarify signature verification in chainsaw

Modified:
    websites/production/logging/content/chainsaw/2.0.0/download.html

Modified: websites/production/logging/content/chainsaw/2.0.0/download.html
==============================================================================
--- websites/production/logging/content/chainsaw/2.0.0/download.html (original)
+++ websites/production/logging/content/chainsaw/2.0.0/download.html Fri Jan 26 19:17:08 2018
@@ -142,16 +142,9 @@
 <h2><a name="Download"></a>Download</h2>
 <p>
 Apache Chainsaw is distributed under the <a href="https://www.apache.org/licenses/LICENSE-2.0.html">Apache License, version 2.0</a>.
+<!-- TODO: the below was added manually and should be backported to the main repo -->
 Version 2.0.0 was released on 2018-01-25.
-All artifacts are signed by GPG.
-<a href="https://www.apache.org/dist/logging/KEYS">Download the GPG keys here</a>.
-To import that file:
 </p>
-<pre>gpg --import KEYS</pre>
-<p>
-To verify a pair of files <code>foo</code> and <code>foo.asc</code>:
-</p>
-<pre>gpg --verify foo.asc foo</pre>
 <table>
     <tr>
         <th>Distribution</th>
@@ -185,6 +178,26 @@ To verify a pair of files <code>foo</cod
     </tr>
 </table>
 
+<p>
+It is essential that you verify the integrity of the downloaded files using the PGP or MD5 signatures.
+Please read <a href="https://httpd.apache.org/dev/verification.html">Verifying Apache HTTP Server Releases</a> for more information on why you should verify our releases.
+</p>
+<p>
+The PGP signatures can be verified using PGP or GPG.
+First download the <a href="https://www.apache.org/dist/logging/KEYS">KEYS</a> as well as the asc signature file for the relevant distribution.
+Make sure you get these files from the <a href="https://www.apache.org/dist/logging/chainsaw/">main distribution directory</a>, rather than from a mirror.
+Then verify the signatures using
+</p>
+<pre>
+gpg --import KEYS
+gpg --verify apache-chainsaw-2.0.0-bin.tar.gz.asc apache-chainsaw-2.0.0-bin.tar.gz
+</pre>
+<p>
+Apache Chainsaw is signed by Matt Sicker with the GPG key fingerprint <code>748F 15B2 CF9B A8F0 2415  5E6E D7C9 2B70 FA1C 814D</code>.
+Alternatively, artifacts can be verified using either the provided MD5 checksums or SHA-512 checksums.
+A program such as <code>shasum</code> or <code>sha512sum</code> can be used for this, or subcommands of <code>gpg</code> or <code>openssl</code> can also verify checksums.
+</p>
+
 <p>Please check the <a href="distributionnotes.html">Important Distribution Notes</a> for more information about some of the extended feature sets.</p></li></ul></div>
       </div>
     </div>