Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update the signature verification steps #3257

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Update the signature verification steps #3257

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e1ad86d
Update the signature verification steps
Tatskaari Sep 18, 2024
c63e3c3
Update docs/faq.html
Tatskaari Oct 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 15 additions & 10 deletions docs/faq.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,21 +68,26 @@ <h2 id="run" class="title-2">
<h2 class="title-2" id="verify">How can I verify the download of Please?</h2>

<p>
All our release artifacts are signed with a GPG key. If you want assurance that
All our release artifacts are signed with a private rsa key. If you want assurance that
Tatskaari marked this conversation as resolved.
Show resolved Hide resolved
they have not been tampered with since, you can use the signatures to verify them.</p>
</p>

<p>First, fetch the Please release key:
<pre><code class="code">gpg --recv-keys 3A6C0AE370E18496045687A9B85AEAE1AA1D5142</code></pre>
This should receive key <code class="code">B85AEAE1AA1D5142</code> for
<code class="code">Please Releases &lt;[email protected]&gt;</code>.</p>
<p>To get the public key:
<pre class="code-container">
<!-- prettier-ignore -->
<code>
curl -O https://please.build/key.pub
</code>
</pre>
</p>

<p>To verify the download script:
<pre class="code-container">
<!-- prettier-ignore -->
<code>
curl -O https://get.please.build/get_plz.sh
curl -O https://get.please.build/get_plz.sh.asc
gpg --verify get_plz.sh.asc get_plz.sh
curl -O https://get.please.build/get_plz.sh.sig
openssl dgst -sha256 -verify key.pub --signature get_plz.sh.sig get_plz.sh
</code>
</pre>
You can now run that directly to install Please.
Expand All @@ -93,10 +98,10 @@ <h2 class="title-2" id="verify">How can I verify the download of Please?</h2>
<!-- prettier-ignore -->
<code>
ARCH="linux_amd64"
VERSION="16.0.0"
VERSION="17.0.0"
curl -O https://get.please.build/${ARCH}/${VERSION}/please_${VERSION}
curl -O https://get.please.build/${ARCH}/${VERSION}/please_${VERSION}.asc
gpg --verify please_${VERSION}.asc please_${VERSION}
curl -O https://get.please.build/${ARCH}/${VERSION}/please_${VERSION}.sig
openssl dgst -sha256 -verify key.pub --signature please_${VERSION}.sig please_${VERSION}
</code>
</pre>
You can now use this Please binary on your machine as you please!
Expand Down
Loading