Author: kwright
Date: Tue Apr 22 11:23:47 2014
New Revision: 1589090
URL: http://svn.apache.org/r1589090
Log:
Update verification instructions
Modified:
manifoldcf/site/trunk/src/documentation/content/xdocs/en_US/verify.xml
Modified: manifoldcf/site/trunk/src/documentation/content/xdocs/en_US/verify.xml
URL:
http://svn.apache.org/viewvc/manifoldcf/site/trunk/src/documentation/content/xdocs/en_US/verify.xml?rev=1589090&r1=1589089&r2=1589090&view=diff
==============================================================================
--- manifoldcf/site/trunk/src/documentation/content/xdocs/en_US/verify.xml
(original)
+++ manifoldcf/site/trunk/src/documentation/content/xdocs/en_US/verify.xml Tue
Apr 22 11:23:47 2014
@@ -39,7 +39,48 @@
<section>
<title>Verifying a release</title>
- <p>MHL</p>
+
+ <section>
+ <title>Importing the public keys</title>
+ <p>Each release comes with a KEYS file. Before you can verify the
release artifacts, you must import the
+ KEYS file into OpenPGP.</p>
+ <p>Start by downloading the KEYS file for the release to your local
machine. Be sure that you download this
+ file from an Apache server -- not a mirror, or third-party server,
but from www.apache.org itself.
+ If you want, you can also verify that the contents of the KEYS
file consists only of public keys that have been
+ registered with various key authorities, such as <a
href="http://pgp.mit.edu/";>MIT's</a>.</p>
+ <p>Next, load the KEYS file into OpenPGP, using a command like
this:</p>
+ <p><code>gpg --import KEYS</code></p>
+ <p>Perform the most basic level of verification by downloading the ASC
signature file for the artifact, and then
+ running a command such as this (good for both Windows and
Unix):</p>
+ <p><code>gpg --verify apache-manifoldcf-X.X.X-src.tar.gz.asc</code></p>
+ </section>
+
+ <section>
+ <title>Verifying the MD5 signature</title>
+ <p>To verify the MD5 signature of a release, download the artifact and
the MD5 signature file for the artifact, and then
+ run a Unix command such as this:</p>
+ <p><code>gpg --print-md MD5 apache-manifoldcf-X.X.X-src.tar.gz | diff
- apache-manifoldcf-X.X.X-src.tar.gz.md5</code></p>
+ <p>On Windows:</p>
+ <p>
+ <code>gpg --print-md MD5 apache-manifoldcf-X.X.X-src.tar.gz >
capture.md5</code>
+ <code>fc capture.md5 apache-manifoldcf-X.X.X-src.tar.gz.md5</code>
+ </p>
+ <p>No differences will be printed if the signatures agree. If there
are differences, then the release cannot be verified.</p>
+ </section>
+
+ <section>
+ <title>Verifying the SHA signature</title>
+ <p>To verify the SHA signature of a release, download the artifact and
the SHA signature file for the artifact, and then
+ run a Unix command such as this:</p>
+ <p><code>gpg --print-md SHA512 apache-manifoldcf-X.X.X-src.tar.gz |
diff - apache-manifoldcf-X.X.X-src.tar.gz.sha</code></p>
+ <p>On Windows:</p>
+ <p>
+ <code>gpg --print-md SHA512 apache-manifoldcf-X.X.X-src.tar.gz >
capture.sha</code>
+ <code>fc capture.md5 apache-manifoldcf-X.X.X-src.tar.gz.sha</code>
+ </p>
+ <p>No differences will be printed if the signatures agree. If there
are differences, then the release cannot be verified.</p>
+ </section>
+
</section>
</body>
