2014-08-12 20:17:30 +00:00
|
|
|
When you download a git-annex package from downloads.kitenet.net,
|
|
|
|
|
as listed in [[install]], you should use a https connection. That provides
|
|
|
|
|
some security, but here's some more.
|
|
|
|
|
|
|
|
|
|
The downloaded package's integrity can be verified by checking that
|
|
|
|
|
it was signed using the right GPG key, specifically the git-annex
|
|
|
|
|
distribution signing key. To do this, you need to download the .sig
|
|
|
|
|
file accompanying your package. Just append .sig to the url.
|
|
|
|
|
|
|
|
|
|
For example, on Linux:
|
|
|
|
|
|
2014-10-24 17:58:32 +00:00
|
|
|
$ wget https://downloads.kitenet.net/git-annex/linux/current/git-annex-standalone-amd64.tar.gz
|
|
|
|
|
$ wget https://downloads.kitenet.net/git-annex/linux/current/git-annex-standalone-amd64.tar.gz.sig
|
2014-08-12 20:17:30 +00:00
|
|
|
|
|
|
|
|
You can then download the public key, and check that the package is signed
|
|
|
|
|
with it.
|
|
|
|
|
|
|
|
|
|
$ wget https://downloads.kitenet.net/git-annex/gpg-pubkey.asc
|
2015-07-19 13:27:31 +00:00
|
|
|
$ gpg --import gpg-pubkey.asc
|
2014-08-12 20:17:30 +00:00
|
|
|
$ gpg --verify git-annex-standalone-*.tar.gz.sig
|
|
|
|
|
|
|
|
|
|
(The git-annex assistant can automatically upgrade git-annex, and when it
|
|
|
|
|
does, it always checks the signature like that.)
|
|
|
|
|
|
|
|
|
|
But, how do you know that the gpg-pubkey.asc you downloaded
|
|
|
|
|
is the right key? The answer is the GPG web of trust.
|
|
|
|
|
|
|
|
|
|
* Joey Hess generates these git-annex packages,
|
2021-01-26 16:01:58 +00:00
|
|
|
and has a GPG key, C910D9222512E3C7 Joey Hess <id@joeyh.name>, which has
|
2014-08-12 20:51:15 +00:00
|
|
|
been verified and signed by many people.
|
2014-08-13 15:06:34 +00:00
|
|
|
* Joey's GPG key has signed the git-annex distribution signing key.
|
2014-10-24 18:02:53 +00:00
|
|
|
|
|
|
|
|
Don't take this page's word about this, check it yourself!
|
