You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by bu...@apache.org on 2016/01/25 08:02:12 UTC
svn commit: r978519 - in /websites/staging/httpd/trunk/content: ./
dev/verification.html download.html
Author: buildbot
Date: Mon Jan 25 07:02:12 2016
New Revision: 978519
Log:
Staging update by buildbot for httpd
Modified:
websites/staging/httpd/trunk/content/ (props changed)
websites/staging/httpd/trunk/content/dev/verification.html
websites/staging/httpd/trunk/content/download.html
Propchange: websites/staging/httpd/trunk/content/
------------------------------------------------------------------------------
--- cms:source-revision (original)
+++ cms:source-revision Mon Jan 25 07:02:12 2016
@@ -1 +1 @@
-1722594
+1726581
Modified: websites/staging/httpd/trunk/content/dev/verification.html
==============================================================================
--- websites/staging/httpd/trunk/content/dev/verification.html (original)
+++ websites/staging/httpd/trunk/content/dev/verification.html Mon Jan 25 07:02:12 2016
@@ -107,28 +107,28 @@ the mirrors for the release and the offi
this happens automatically for you.)</p>
<h1 id="Checking">Checking Signatures<a class="headerlink" href="#Checking" title="Permanent link">¶</a></h1>
<p>The following example details how signature interaction works. In this
-example, you are already assumed to have downloaded <code>httpd-2.0.44.tar.gz</code>
-(the release) and <code>httpd-2.0.44.tar.gz.asc</code> (the detached signature).</p>
+example, you are already assumed to have downloaded <code>httpd-2.4.18.tar.gz</code>
+(the release) and <code>httpd-2.4.18.tar.gz.asc</code> (the detached signature).</p>
<p>This example uses <a href="http://www.gnupg.org/">The GNU Privacy Guard</a>. Any
<a href="http://www.openpgp.org/">OpenPGP</a> -compliant program should work
successfully.</p>
-<p>First, we will check the detached signature ( <code>httpd-2.0.44.tar.gz.asc</code> )
-against our release ( <code>httpd-2.0.44.tar.gz</code> ).</p>
-<div class="codehilite"><pre><span class="c">% gpg httpd-2.0.44.tar.gz.asc</span>
-<span class="n">gpg</span><span class="p">:</span> <span class="n">Signature</span> <span class="n">made</span> <span class="n">Sat</span> <span class="n">Jan</span> 18 07<span class="p">:</span>21<span class="p">:</span>28 2003 <span class="n">PST</span> <span class="n">using</span> <span class="n">DSA</span> <span class="n">key</span> <span class="n">ID</span> <span class="n">DE885DD3</span>
+<p>First, we will check the detached signature ( <code>httpd-2.4.18.tar.gz.asc</code> )
+against our release ( <code>httpd-2.4.18.tar.gz</code> ).</p>
+<div class="codehilite"><pre><span class="c">% gpg --verify httpd-2.4.18.tar.gz.asc httpd-2.4.18.tar.gz</span>
+<span class="n">gpg</span><span class="p">:</span> <span class="n">Signature</span> <span class="n">made</span> <span class="n">Tue</span> <span class="n">Dec</span> 8 21<span class="p">:</span>32<span class="p">:</span>07 2015 <span class="n">CET</span> <span class="n">using</span> <span class="n">RSA</span> <span class="n">key</span> <span class="n">ID</span> 791485<span class="n">A8</span>
<span class="n">gpg</span><span class="p">:</span> <span class="n">Can</span><span class="o">'</span><span class="n">t</span> <span class="n">check</span> <span class="n">signature</span><span class="p">:</span> <span class="n">public</span> <span class="n">key</span> <span class="n">not</span> <span class="n">found</span>
</pre></div>
-<p>We don't have the release manager's public key ( <code>DE885DD3</code> ) in our local
+<p>We don't have the release manager's public key ( <code>791485A8</code> ) in our local
system. You now need to retrieve the public key from a key server. One
popular server is <code>pgpkeys.mit.edu</code> (which has a <a href="http://pgp.mit.edu/">web
interface</a> ). The public key servers are linked
together, so you should be able to connect to any key server.</p>
-<div class="codehilite"><pre><span class="c">% gpg --keyserver pgpkeys.mit.edu --recv-key DE885DD3</span>
-<span class="n">gpg</span><span class="p">:</span> <span class="n">requesting</span> <span class="n">key</span> <span class="n">DE885DD3</span> <span class="n">from</span> <span class="n">HKP</span> <span class="n">keyserver</span> <span class="n">pgpkeys</span><span class="p">.</span><span class="n">mit</span><span class="p">.</span><span class="n">edu</span>
+<div class="codehilite"><pre><span class="c">% gpg --keyserver pgpkeys.mit.edu --recv-key 791485A8</span>
+<span class="n">gpg</span><span class="p">:</span> <span class="n">requesting</span> <span class="n">key</span> 791485<span class="n">A8</span> <span class="n">from</span> <span class="n">HKP</span> <span class="n">keyserver</span> <span class="n">pgpkeys</span><span class="p">.</span><span class="n">mit</span><span class="p">.</span><span class="n">edu</span>
<span class="n">gpg</span><span class="p">:</span> <span class="n">trustdb</span> <span class="n">created</span>
-<span class="n">gpg</span><span class="p">:</span> <span class="n">key</span> <span class="n">DE885DD3</span><span class="p">:</span> <span class="n">public</span> <span class="n">key</span> "<span class="n">Sander</span> <span class="n">Striker</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">striker</span><span class="p">@</span><span class="n">apache</span><span class="p">.</span><span class="n">org</span><span class="o">&</span><span class="n">gt</span><span class="p">;</span>"
+<span class="n">gpg</span><span class="p">:</span> <span class="n">key</span> 791485<span class="n">A8</span><span class="p">:</span> <span class="n">public</span> <span class="n">key</span> "<span class="n">Jim</span> <span class="n">Jagielski</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">jim</span><span class="p">@</span><span class="n">apache</span><span class="p">.</span><span class="n">org</span><span class="o">&</span><span class="n">gt</span><span class="p">;</span>"
<span class="n">imported</span>
<span class="n">gpg</span><span class="p">:</span> <span class="n">Total</span> <span class="n">number</span> <span class="n">processed</span><span class="p">:</span> 1
<span class="n">gpg</span><span class="p">:</span> <span class="n">imported</span><span class="p">:</span> 1
@@ -136,26 +136,28 @@ together, so you should be able to conne
<p>In this example, you have now received a public key for an entity known as
-'Sander Striker <striker@apache.org>' However, you have no way of
-verifying this key was created by the person known as Sander Striker. But,
+'Jim Jagielski <jim@apache.org>' However, you have no way of
+verifying this key was created by the person known as Jim Jagielski. But,
let's try to verify the release signature again.</p>
-<div class="codehilite"><pre><span class="c">% gpg httpd-2.0.44.tar.gz.asc</span>
-<span class="n">gpg</span><span class="p">:</span> <span class="n">Signature</span> <span class="n">made</span> <span class="n">Sat</span> <span class="n">Jan</span> 18 07<span class="p">:</span>21<span class="p">:</span>28 2003 <span class="n">PST</span> <span class="n">using</span> <span class="n">DSA</span> <span class="n">key</span> <span class="n">ID</span> <span class="n">DE885DD3</span>
-<span class="n">gpg</span><span class="p">:</span> <span class="n">Good</span> <span class="n">signature</span> <span class="n">from</span> "<span class="n">Sander</span> <span class="n">Striker</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">striker</span><span class="p">@</span><span class="n">apache</span><span class="p">.</span><span class="n">org</span><span class="o">&</span><span class="n">gt</span><span class="p">;</span>"
-<span class="n">gpg</span><span class="p">:</span> <span class="n">aka</span> "<span class="n">Sander</span> <span class="n">Striker</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">striker</span><span class="p">@</span><span class="n">striker</span><span class="p">.</span><span class="n">nl</span><span class="o">&</span><span class="n">gt</span><span class="p">;</span>"
+<div class="codehilite"><pre><span class="c">% gpg --verify httpd-2.4.18.tar.gz.asc httpd-2.4.18.tar.gz</span>
+<span class="n">gpg</span><span class="p">:</span> <span class="n">Signature</span> <span class="n">made</span> <span class="n">Tue</span> <span class="n">Dec</span> 8 21<span class="p">:</span>32<span class="p">:</span>07 2015 <span class="n">CET</span> <span class="n">using</span> <span class="n">RSA</span> <span class="n">key</span> <span class="n">ID</span> 791485<span class="n">A8</span>
+<span class="n">gpg</span><span class="p">:</span> <span class="n">Good</span> <span class="n">signature</span> <span class="n">from</span> "<span class="n">Jim</span> <span class="n">Jagielski</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">jim</span><span class="p">@</span><span class="n">apache</span><span class="p">.</span><span class="n">org</span><span class="o">&</span><span class="n">gt</span><span class="p">;</span>"
+<span class="n">gpg</span><span class="p">:</span> <span class="n">aka</span> "<span class="n">Jim</span> <span class="n">Jagielski</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">jim</span><span class="p">@</span><span class="n">jimjag</span><span class="p">.</span><span class="n">com</span><span class="o">&</span><span class="n">gt</span><span class="p">;</span>"
+<span class="n">gpg</span><span class="p">:</span> <span class="n">aka</span> "<span class="n">Jim</span> <span class="n">Jagielski</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">jim</span><span class="p">@</span><span class="n">jaguNET</span><span class="p">.</span><span class="n">com</span><span class="o">&</span><span class="n">gt</span><span class="p">;</span>"
+<span class="n">gpg</span><span class="p">:</span> <span class="n">aka</span> "<span class="n">Jim</span> <span class="n">Jagielski</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">jimjag</span><span class="p">@</span><span class="n">gmail</span><span class="p">.</span><span class="n">com</span><span class="o">&</span><span class="n">gt</span><span class="p">;</span>"
<span class="n">gpg</span><span class="p">:</span> <span class="n">checking</span> <span class="n">the</span> <span class="n">trustdb</span>
<span class="n">gpg</span><span class="p">:</span> <span class="n">no</span> <span class="n">ultimately</span> <span class="n">trusted</span> <span class="n">keys</span> <span class="n">found</span>
<span class="n">gpg</span><span class="p">:</span> <span class="n">WARNING</span><span class="p">:</span> <span class="n">This</span> <span class="n">key</span> <span class="n">is</span> <span class="n">not</span> <span class="n">certified</span> <span class="n">with</span> <span class="n">a</span> <span class="n">trusted</span> <span class="n">signature</span>!
<span class="n">gpg</span><span class="p">:</span> <span class="n">There</span> <span class="n">is</span> <span class="n">no</span> <span class="n">indication</span> <span class="n">that</span> <span class="n">the</span> <span class="n">signature</span> <span class="n">belongs</span> <span class="n">to</span> <span class="n">the</span>
<span class="n">owner</span><span class="p">.</span>
-<span class="n">Fingerprint</span><span class="p">:</span> 4<span class="n">C1E</span> <span class="n">ADAD</span> <span class="n">B4EF</span> 5007 579<span class="n">C</span> 919<span class="n">C</span> 6635 <span class="n">B6C0</span> <span class="n">DE88</span> 5<span class="n">DD3</span>
+<span class="n">Fingerprint</span><span class="p">:</span> <span class="n">A93D</span> 62<span class="n">EC</span> <span class="n">C3C8</span> <span class="n">EA12</span> <span class="n">DB22</span> 0<span class="n">EC9</span> 34<span class="n">EA</span> 76<span class="n">E6</span> 7914 85<span class="n">A8</span>
</pre></div>
<p>At this point, the signature is good, but we don't trust this key. A good
signature means that the file has not been tampered. However, due to the
nature of public key cryptography, you need to additionally verify that key
-DE885DD3 was created by the <strong>real</strong> Sander Striker.</p>
+791485A8 was created by the <strong>real</strong> Jim Jagielski.</p>
<p>Any attacker can create a public key and upload it to the public key
servers. They can then create a malicious release signed by this fake key.
Then, if you tried to verify the signature of this corrupt release, it
@@ -170,11 +172,14 @@ release verifies as good, you need to va
an official representative of the Apache HTTP Server Project.</p>
<p>The crucial step to validation is to confirm the key fingerprint of the
public key.</p>
-<div class="codehilite"><pre><span class="c">% gpg --fingerprint DE885DD3</span>
-<span class="n">pub</span> 1024<span class="n">D</span><span class="o">/</span><span class="n">DE885DD3</span> 2002<span class="o">-</span>04<span class="o">-</span>10 <span class="n">Sander</span> <span class="n">Striker</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">striker</span><span class="p">@</span><span class="n">apache</span><span class="p">.</span><span class="n">org</span><span class="o">&</span><span class="n">gt</span><span class="p">;</span>
-<span class="n">Key</span> <span class="n">fingerprint</span> <span class="p">=</span> 4<span class="n">C1E</span> <span class="n">ADAD</span> <span class="n">B4EF</span> 5007 579<span class="n">C</span> 919<span class="n">C</span> 6635 <span class="n">B6C0</span> <span class="n">DE88</span> 5<span class="n">DD3</span>
-<span class="n">uid</span> <span class="n">Sander</span> <span class="n">Striker</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">striker</span><span class="p">@</span><span class="n">striker</span><span class="p">.</span><span class="n">nl</span><span class="o">&</span><span class="n">gt</span><span class="p">;</span>
-<span class="n">sub</span> 2048<span class="n">g</span><span class="o">/</span>532<span class="n">D14CA</span> 2002<span class="o">-</span>04<span class="o">-</span>10
+<div class="codehilite"><pre><span class="c">% gpg --fingerprint 791485A8</span>
+<span class="n">pub</span> 4096<span class="n">R</span><span class="o">/</span>791485<span class="n">A8</span> 2010<span class="o">-</span>11<span class="o">-</span>04 2002<span class="o">-</span>04<span class="o">-</span>10
+ <span class="n">Key</span> <span class="n">fingerprint</span> <span class="p">=</span> <span class="n">A93D</span> 62<span class="n">EC</span> <span class="n">C3C8</span> <span class="n">EA12</span> <span class="n">DB22</span> 0<span class="n">EC9</span> 34<span class="n">EA</span> 76<span class="n">E6</span> 7914 85<span class="n">A8</span>
+<span class="n">uid</span> <span class="n">Jim</span> <span class="n">Jagielski</span> <span class="p">(</span><span class="n">Release</span> <span class="n">Signing</span> <span class="n">Key</span><span class="p">)</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">jim</span><span class="p">@</span><span class="n">apache</span><span class="p">.</span><span class="n">org</span><span class="o">&</span><span class="n">lt</span><span class="p">;</span>
+<span class="n">uid</span> <span class="n">Jim</span> <span class="n">Jagielski</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">jim</span><span class="p">@</span><span class="n">jimjag</span><span class="p">.</span><span class="n">com</span><span class="o">&</span><span class="n">lt</span><span class="p">;</span>
+<span class="n">uid</span> <span class="n">Jim</span> <span class="n">Jagielski</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">jim</span><span class="p">@</span><span class="n">jaguNET</span><span class="p">.</span><span class="n">com</span><span class="o">&</span><span class="n">lt</span><span class="p">;</span>
+<span class="n">uid</span> <span class="n">Jim</span> <span class="n">Jagielski</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">jimjag</span><span class="p">@</span><span class="n">gmail</span><span class="p">.</span><span class="n">com</span><span class="o">&</span><span class="n">lt</span><span class="p">;</span>
+<span class="n">sub</span> 4096<span class="n">R</span><span class="o">/</span>9<span class="n">B6D9BF7</span> 2010<span class="o">-</span>11<span class="o">-</span>04
</pre></div>
@@ -190,28 +195,24 @@ keyring</a>.</p>
others' keys (usually with face-to-face validation). Therefore, in order to
enter the web of trust, you should only need to validate one person in our
web of trust. (Hint: all of our developers' keys are in the KEYS file.)</p>
-<p>For example, the following people have signed the public key for Sander
-Striker. If you verify any key on this list, you will have a trust path to
-the DE885DD3 key. If you verify a key that verifies one of the signatories
-for DE885DD3, then you will have a trust path. (So on, and so on.)</p>
-<div class="codehilite"><pre><span class="n">pub</span> 1024<span class="n">D</span><span class="o">/</span><span class="n">DE885DD3</span> 2002<span class="o">-</span>04<span class="o">-</span>10 <span class="n">Sander</span> <span class="n">Striker</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">striker</span><span class="p">@</span><span class="n">apache</span><span class="p">.</span><span class="n">org</span><span class="o">&</span><span class="n">gt</span><span class="p">;</span>
-<span class="n">sig</span> <span class="n">E2226795</span> 2002<span class="o">-</span>05<span class="o">-</span>01 <span class="n">Justin</span> <span class="n">R</span><span class="p">.</span> <span class="n">Erenkrantz</span>
-<span class="n">sig</span> 3 <span class="n">DE885DD3</span> 2002<span class="o">-</span>04<span class="o">-</span>10 <span class="n">Sander</span> <span class="n">Striker</span>
-<span class="n">sig</span> <span class="n">CD4DF205</span> 2002<span class="o">-</span>05<span class="o">-</span>28 <span class="n">Wolfram</span> <span class="n">Schlich</span>
-<span class="n">sig</span> <span class="n">E005C9CB</span> 2002<span class="o">-</span>11<span class="o">-</span>17 <span class="n">Greg</span> <span class="n">Stein</span>
-<span class="n">sig</span> <span class="n">CC8B0F7E</span> 2002<span class="o">-</span>11<span class="o">-</span>18 <span class="n">Aaron</span> <span class="n">Bannert</span>
-<span class="n">sig</span> <span class="n">DFEAC4B9</span> 2002<span class="o">-</span>11<span class="o">-</span>19 <span class="n">David</span> <span class="n">N</span><span class="p">.</span> <span class="n">Welton</span>
-<span class="n">sig</span> 2 82<span class="n">AB7BD1</span> 2002<span class="o">-</span>11<span class="o">-</span>17 <span class="n">Cliff</span> <span class="n">Woolley</span>
-<span class="n">sig</span> 2 13046155 2002<span class="o">-</span>11<span class="o">-</span>28 <span class="n">Thom</span> <span class="n">May</span>
-<span class="n">sig</span> 3 19311<span class="n">B00</span> 2002<span class="o">-</span>11<span class="o">-</span>17 <span class="n">Chuck</span> <span class="n">Murcko</span>
-<span class="n">sig</span> 3 <span class="n">F894BE12</span> 2002<span class="o">-</span>11<span class="o">-</span>17 <span class="n">Brian</span> <span class="n">William</span> <span class="n">Fitzpatrick</span>
-<span class="n">sig</span> 3 5<span class="n">C1C3AD7</span> 2002<span class="o">-</span>11<span class="o">-</span>18 <span class="n">David</span> <span class="n">Reid</span>
-<span class="n">sig</span> 3 <span class="n">E04F9A89</span> 2002<span class="o">-</span>11<span class="o">-</span>18 <span class="n">Roy</span> <span class="n">T</span><span class="p">.</span> <span class="n">Fielding</span>
-<span class="n">sig</span> 3 <span class="n">CC78C893</span> 2002<span class="o">-</span>11<span class="o">-</span>19 <span class="n">Rich</span> <span class="n">Bowen</span>
-<span class="n">sig</span> 3 08<span class="n">C975E5</span> 2002<span class="o">-</span>11<span class="o">-</span>21 <span class="n">Jim</span> <span class="n">Jagielski</span>
-<span class="n">sig</span> 3 <span class="n">F88341D9</span> 2002<span class="o">-</span>11<span class="o">-</span>18 <span class="n">Lars</span> <span class="n">Eilebrecht</span>
-<span class="n">sig</span> 3 187<span class="n">BD68D</span> 2002<span class="o">-</span>11<span class="o">-</span>21 <span class="n">Ben</span> <span class="n">Hyde</span>
-<span class="n">sig</span> 3 49<span class="n">A563D9</span> 2002<span class="o">-</span>11<span class="o">-</span>23 <span class="n">Mark</span> <span class="n">Cox</span>
+<p>For example, the following people have signed the public key for Jim Jagielski.
+If you verify any key on this list, you will have a trust path to
+the 791485A8 key. If you verify a key that verifies one of the signatories
+for 791485A8, then you will have a trust path. (So on, and so on.)</p>
+<div class="codehilite"><pre><span class="c">% gpg --list-sigs </span>
+<span class="n">pub</span> 4096<span class="n">R</span><span class="o">/</span>791485<span class="n">A8</span> 2010<span class="o">-</span>11<span class="o">-</span>04
+<span class="n">uid</span> <span class="n">Jim</span> <span class="n">Jagielski</span> <span class="p">(</span><span class="n">Release</span> <span class="n">Signing</span> <span class="n">Key</span><span class="p">)</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">jim</span><span class="p">@</span><span class="n">apache</span><span class="p">.</span><span class="n">org</span><span class="o">&</span><span class="n">lt</span><span class="p">;</span>
+<span class="n">sig</span> 88<span class="n">C3A5A5</span> 2010<span class="o">-</span>11<span class="o">-</span>07 <span class="n">Philippe</span> <span class="n">M</span><span class="p">.</span> <span class="n">Chiasson</span> <span class="p">(</span><span class="n">Home</span><span class="p">)</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">gozer</span><span class="p">@</span><span class="n">ectoplasm</span><span class="p">.</span><span class="n">org</span><span class="o">&</span><span class="n">lt</span><span class="p">;</span>
+<span class="n">sig</span> 4<span class="n">E24517C</span> 2011<span class="o">-</span>11<span class="o">-</span>10 <span class="n">Hyrum</span> <span class="n">K</span><span class="p">.</span> <span class="n">Wright</span> <span class="p">(</span><span class="n">Personal</span><span class="p">)</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">hyrum</span><span class="p">@</span><span class="n">hyrumwright</span><span class="p">.</span><span class="n">org</span><span class="o">&</span><span class="n">lt</span><span class="p">;</span>
+<span class="n">sig</span> <span class="n">C4FC9A65</span> 2011<span class="o">-</span>11<span class="o">-</span>10 <span class="n">Bernd</span> <span class="n">Bohmann</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">bommel</span><span class="p">@</span><span class="n">apache</span><span class="p">.</span><span class="n">org</span><span class="o">&</span><span class="n">lt</span><span class="p">;</span>
+<span class="n">sig</span> 1<span class="n">F27E622</span> 2015<span class="o">-</span>04<span class="o">-</span>16 <span class="n">Konstantin</span> <span class="n">I</span> <span class="n">Boudnik</span> <span class="p">(</span><span class="n">Cos</span><span class="p">)</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="nb">cos</span><span class="p">@</span><span class="n">boudnik</span><span class="p">.</span><span class="n">org</span><span class="o">&</span><span class="n">lt</span><span class="p">;</span>
+<span class="n">sig</span> 08<span class="n">C975E5</span> 2010<span class="o">-</span>11<span class="o">-</span>04 <span class="n">Jim</span> <span class="n">Jagielski</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">jim</span><span class="p">@</span><span class="n">apache</span><span class="p">.</span><span class="n">org</span><span class="o">&</span><span class="n">lt</span><span class="p">;</span>
+<span class="n">sig</span> 2 <span class="n">F2EFD0F0</span> 2011<span class="o">-</span>11<span class="o">-</span>14 <span class="n">Christopher</span> <span class="n">David</span> <span class="n">Schultz</span> <span class="p">(</span><span class="n">Christopher</span> <span class="n">David</span> <span class="n">Schultz</span><span class="p">)</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">chris</span><span class="p">@</span><span class="n">christopherschultz</span><span class="p">.</span><span class="n">net</span><span class="o">&</span><span class="n">lt</span><span class="p">;</span>
+<span class="n">sig</span> 3 311<span class="n">A3DE5</span> 2010<span class="o">-</span>11<span class="o">-</span>10 <span class="n">Ruediger</span> <span class="n">Pluem</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">rpluem</span><span class="p">@</span><span class="n">apache</span><span class="p">.</span><span class="n">org</span><span class="o">&</span><span class="n">lt</span><span class="p">;</span>
+<span class="n">sig</span> 64<span class="n">A6A0BA</span> 2013<span class="o">-</span>02<span class="o">-</span>27 <span class="n">Steven</span> <span class="n">J</span><span class="p">.</span> <span class="n">Hathaway</span> <span class="p">(</span><span class="n">Apache</span> <span class="n">PGP</span><span class="p">)</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">shathaway</span><span class="p">@</span><span class="n">apache</span><span class="p">.</span><span class="n">org</span><span class="o">&</span><span class="n">lt</span><span class="p">;</span>
+<span class="n">sig</span> 00<span class="n">A1234F</span> 2015<span class="o">-</span>04<span class="o">-</span>15 <span class="n">Andre</span> <span class="n">Arcilla</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">arcilla</span><span class="p">@</span><span class="n">apache</span><span class="p">.</span><span class="n">org</span><span class="o">&</span><span class="n">lt</span><span class="p">;</span>
+<span class="n">sig</span> 9<span class="n">A59B973</span> 2015<span class="o">-</span>04<span class="o">-</span>21 <span class="n">Stefan</span> <span class="n">Sperling</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">stsp</span><span class="p">@</span><span class="n">stsp</span><span class="p">.</span><span class="n">name</span><span class="o">&</span><span class="n">lt</span><span class="p">;</span>
+<span class="n">sig</span> <span class="n">F51BB88A</span> 2010<span class="o">-</span>11<span class="o">-</span>04 <span class="n">Sander</span> <span class="n">Temme</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">sander</span><span class="p">@</span><span class="n">temme</span><span class="p">.</span><span class="n">net</span><span class="o">&</span><span class="n">lt</span><span class="p">;</span>
<span class="p">...</span><span class="n">more</span> <span class="n">signatures</span> <span class="n">redacted</span><span class="p">...</span>
</pre></div>
@@ -225,10 +226,12 @@ able to find someone who will be willing
alternate mechanisms for validation.</p>
<p>Once you have entered the web of trust, you should see the following upon
verifying the signature of a release.</p>
-<div class="codehilite"><pre><span class="c">% gpg httpd-2.0.44.tar.gz.asc</span>
-<span class="n">gpg</span><span class="p">:</span> <span class="n">Signature</span> <span class="n">made</span> <span class="n">Sat</span> <span class="n">Jan</span> 18 07<span class="p">:</span>21<span class="p">:</span>28 2003 <span class="n">PST</span> <span class="n">using</span> <span class="n">DSA</span> <span class="n">key</span> <span class="n">ID</span> <span class="n">DE885DD3</span>
-<span class="n">gpg</span><span class="p">:</span> <span class="n">Good</span> <span class="n">signature</span> <span class="n">from</span> "<span class="n">Sander</span> <span class="n">Striker</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">striker</span><span class="p">@</span><span class="n">apache</span><span class="p">.</span><span class="n">org</span><span class="o">&</span><span class="n">gt</span><span class="p">;</span>"
-<span class="n">gpg</span><span class="p">:</span> <span class="n">aka</span> "<span class="n">Sander</span> <span class="n">Striker</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">striker</span><span class="p">@</span><span class="n">striker</span><span class="p">.</span><span class="n">nl</span><span class="o">&</span><span class="n">gt</span><span class="p">;</span>"
+<div class="codehilite"><pre><span class="c">% gpg --verify httpd-2.4.18.tar.gz.asc httpd-2.4.18.tar.gz</span>
+<span class="n">gpg</span><span class="p">:</span> <span class="n">Signature</span> <span class="n">made</span> <span class="n">Tue</span> <span class="n">Dec</span> 8 21<span class="p">:</span>32<span class="p">:</span>07 2015 <span class="n">CET</span> <span class="n">using</span> <span class="n">RSA</span> <span class="n">key</span> <span class="n">ID</span> 791485<span class="n">A8</span>
+<span class="n">gpg</span><span class="p">:</span> <span class="n">Good</span> <span class="n">signature</span> <span class="n">from</span> "<span class="n">Jim</span> <span class="n">Jagielski</span> <span class="p">(</span><span class="n">Release</span> <span class="n">Signing</span> <span class="n">Key</span><span class="p">)</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">jim</span><span class="p">@</span><span class="n">apache</span><span class="p">.</span><span class="n">org</span><span class="o">&</span><span class="n">lt</span><span class="p">;</span>"
+<span class="n">gpg</span><span class="p">:</span> <span class="n">aka</span> "<span class="n">Jim</span> <span class="n">Jagielski</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">jim</span><span class="p">@</span><span class="n">jimjag</span><span class="p">.</span><span class="n">com</span><span class="o">&</span><span class="n">lt</span><span class="p">;</span>"
+<span class="n">gpg</span><span class="p">:</span> <span class="n">aka</span> "<span class="n">Jim</span> <span class="n">Jagielski</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">jim</span><span class="p">@</span><span class="n">jaguNET</span><span class="p">.</span><span class="n">com</span><span class="o">&</span><span class="n">lt</span><span class="p">;</span>"
+<span class="n">gpg</span><span class="p">:</span> <span class="n">aka</span> "<span class="n">Jim</span> <span class="n">Jagielski</span> <span class="o">&</span><span class="n">lt</span><span class="p">;</span><span class="n">jimjag</span><span class="p">@</span><span class="n">gmail</span><span class="p">.</span><span class="n">com</span><span class="o">&</span><span class="n">lt</span><span class="p">;</span>"
</pre></div>
Modified: websites/staging/httpd/trunk/content/download.html
==============================================================================
--- websites/staging/httpd/trunk/content/download.html (original)
+++ websites/staging/httpd/trunk/content/download.html Mon Jan 25 07:02:12 2016
@@ -312,10 +312,10 @@ verify our releases.</p>
signature file for the relevant distribution. Make sure you get these files
from the <a href="http://www.apache.org/dist/httpd/">main distribution directory</a> ,
rather than from a mirror. Then verify the signatures using</p>
-<p><code>% pgpk -a KEYS<br></br>% pgpv httpd-2.2.0.tar.gz.asc<br></br></code>
+<p><code>% pgpk -a KEYS<br></br>% pgpv httpd-2.4.18.tar.gz.asc <br></br></code>
<em>or</em> <br></br><code>% pgp -ka KEYS<br></br>% pgp
-httpd-2.2.0.tar.gz.asc<br></br></code> <em>or</em> <br></br><code>% gpg --import
-KEYS<br></br>% gpg --verify httpd-2.2.0.tar.gz.asc</code></p>
+httpd-2.4.18.tar.gz.asc <br></br></code> <em>or</em> <br></br><code>% gpg --import
+KEYS<br></br>% gpg --verify httpd-2.4.18.tar.gz.asc httpd-2.4.18.tar.gz</code></p>
<ul>
<li>
<p>httpd-2.4.18.tar.* are signed by Jim Jagielski <code>791485A8</code> </p>