Re: [be] Verification of release tar balls

[Teus Benschop]

On Mon, 2010-09-27 at 19:40 +1000, John Marshall wrote:
> The checksums, by themselves, provide a means to verify the integrity of
> the downloaded tar ball (is it OK or corrupted).  A PGP signature
> provides that PLUS a means of verifying the origin of the published tar
> ball.

The GnuPG key-pair was generated and the public key was uploaded to
hkp://keys.gnupg.net. Its ID is 71D6A5C6. The detached signature was
created, and was uploaded to the directory where the tar ball is. This
should give the possibility of verifying the tar balls that they are
good.

Teus