Re: Verifying and checksumming new release is somewhat cumbersom

2020-12-03 Thread Werner Koch via Gnupg-users
On Thu, 3 Dec 2020 07:50, john doe said: > Is the release workflow documented somewhere so a non-dev could look to > implement this ? https://wiki.gnupg.org/AgentForwarding feel free to extend this page if you have remarks. Shalom-Salam, Werner -- Die Gedanken sind frei. Ausnahmen

Re: Verifying and checksumming new release is somewhat cumbersom

2020-12-02 Thread john doe via Gnupg-users
On 11/29/2020 12:53 PM, Werner Koch wrote: On Sat, 28 Nov 2020 07:57, john doe said: If I look at Debian (1) for example, the checksum file is gpg signed. Assuming that I understand correctly, the Debian approach is not a safe way to make the checksums available?propagate? No, that is a safe

Re: Verifying and checksumming new release is somewhat cumbersom

2020-11-29 Thread Werner Koch via Gnupg-users
On Sat, 28 Nov 2020 07:57, john doe said: > If I look at Debian (1) for example, the checksum file is gpg signed. > Assuming that I understand correctly, the Debian approach is not a safe > way to make the checksums available?propagate? No, that is a safe way. Having a separate file with

Re: Verifying and checksumming new release is somewhat cumbersom

2020-11-27 Thread john doe via Gnupg-users
On 11/26/2020 9:10 PM, Werner Koch wrote: Hi, and thanks for asking. Thanks for this. To be sure that I understand you correctly, I took the liberty of rewording your answers. On Thu, 26 Nov 2020 19:12, john doe said: Is there a URL to download those sha1sums and those public keyss as

Re: Verifying and checksumming new release is somewhat cumbersom

2020-11-27 Thread Stefan Claas via Gnupg-users
On Thu, Nov 26, 2020 at 9:18 PM Werner Koch via Gnupg-users wrote: > > Hi, > > and thanks for asking. > > On Thu, 26 Nov 2020 19:12, john doe said: > > > Is there a URL to download those sha1sums and those public keyss as files? > > The problem with sha1sums is that a single publication would be

Verifying and checksumming new release is somewhat cumbersom

2020-11-26 Thread john doe via Gnupg-users
Hello all, I see that at (1) and (2) the public keys block and the sha1sums respectively are listed on their corresponding page. Is there a URL to download those sha1sums and those public keyss as files? That is for checksumming I could simply do: $ wget $ sha1sum -c --ignore-missing and