Re: [be] Verification of release tar balls

[Jonathan Marsden]

Teus,

On 9/24/2010 11:03 AM, Teus Benschop wrote:

> The build computer is different from the web server. The scripts
> given by Jonathan were excellent. They made it easy to at once grasp
> the idea for making the sums. If there are similar scripts for doing
> the signing with GnuPG, that would help greatly. Teus.

Assuming you have already set up gpg itself, generated a keypair, and
published the public key to the keyservers, then

  gpg -ab bibledit-gtk-4.1.tar.gz

(and providing your gpg passphrase when prompted for it) will create a
detached signature file bibledit-gtk-4.1.tar.gz.asc

Users can later verify this by downloading the pair of .gz and .gz.asc
files, importing the relevant public key from the keyservers, and then
running

  gpg --verify bibledit-gtk-4.1.tar.gz.asc bibledit-gtk-4.1.tar.gz

My opinion is that far fewer users understand this approach than
understand the way to check MD5SUMs, and it is less easily automatable
(because you have to import the specific public key involved) so while
the level of verification is definitely higher, the chance that someone
will actually take the time to verify a file this way is lower.  It's
good practice to provide both, of course :)

Jonathan