laantungir/seedsigner
1
0
Fork 0
mirror of https://github.com/SeedSigner/seedsigner.git synced 2026-10-05 15:08:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Make gpg commands version agnostic

Browse Source
This commit is contained in:
namcios
2022-04-18 18:47:35 -05:00
committed by GitHub
parent 947ed2ef7c
commit c13e88f459
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+6 -6
View File
@@ -84,9 +84,9 @@ After downloading the .zip file, extract the seedsigner .img file, and write it
You can verify the data integrity and authenticity of the latest release with as little as three commands (though moving forward you will have to replace the version in the following commands with the version number you are attempting to validate). This process assumes that you have navigated to a folder where you have these four relevant files present:
* seedsigner_pubkey.gpg (from the main folder of this repo)
* seedsigner_0_4_5.img.zip (from the software release)
* seedsigner_0_4_5.img.zip.sha256 (from the software release)
* seedsigner_0_4_5.img.zip.sha256.sig (from the software release)
* seedsigner_0_X_X.img.zip (from the software release)
* seedsigner_0_X_X.img.zip.sha256 (from the software release)
* seedsigner_0_X_X.img.zip.sha256.sig (from the software release)
This process also assumes you are running the commands from a system where both GPG and shasum are installed and working.
@@ -101,7 +101,7 @@ key <...> not changed
Now you can verify the authenticity of the small text file containing the release's SHA256 hash with the command:
```
gpg --verify seedsigner_0_4_5.img.zip.sha256.sig
gpg --verify seedsigner_0_*_*.img.zip.sha256.sig
```
The reponse to this command should include the text:
```
@@ -111,11 +111,11 @@ The previous command validates that aforementioned small text file was signed us
The last step is to make sure the .zip file that you've downloaded, and that contains the released software, is a perfect match to the software that was published by the holder of the private key in the last step. The command for this step is:
```
shasum -a 256 -c seedsigner_0_4_5.img.zip.sha256
shasum -a 256 -c seedsigner_0_*_*.img.zip.sha256
```
The reponse to this command should include the text:
```
seedsigner_0_4_5.img.zip: OK
seedsigner_0_X_X.img.zip: OK
```
There are other steps you can take to verify the software, including examining the hash value in the .sha256 text file, but this one has been documented here because it seems the simplest for most people to follow. Please recognize that this process can only validate the software to the extent that the entity that first published the key is an honest actor, and assumes the private key has remained uncompromised and is not being used by a malicious actor.