[openssl.org #292] FAQ: How can I check authenticity of a tarball?

[Alessandro Vesely via RT]

I write to ask if you can kindly supply such a FAQ
E.g.

We provide MD5 digests and ASC signatures of each tarball.
Use MD5 to check that a tarball from a mirror site is identical,
e.g.

   md5sum TARBALL | awk '{print $1;}' | cmp - TARBALL.md5

You can check authenticity using pgp or gpg. You need
the OpenSSL team public key used to sign it: download it
from <??????????????????????????????????>. Then just do

   pgp TARBALL.asc

______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
Development Mailing List                       [EMAIL PROTECTED]
Automated List Manager                           [EMAIL PROTECTED]