GraphicsMagick: www/download.rst: Add documentation for how to v...
GraphicsMagick Commits <[email protected]>
| Newsgroups | gmane.comp.video.graphicsmagick.cvs |
|---|---|
| Message-ID | <mailman.23860.1639505937.1995.graphicsmagick-commit@lists.sourceforge.net> |
changeset 9d2a9a161cb2 in /hg/GraphicsMagick details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=9d2a9a161cb2 summary: www/download.rst: Add documentation for how to validate downloaded files. diffstat: ChangeLog | 5 ++ VisualMagick/installer/inc/version.isx | 4 +- magick/version.h | 4 +- www/Changelog.html | 4 + www/download.html | 75 +++++++++++++++++++++++++++++++++- www/download.rst | 66 +++++++++++++++++++++++++++++ www/security.html | 4 +- www/security.rst | 4 +- 8 files changed, 157 insertions(+), 9 deletions(-) diffs (254 lines): diff -r 5c2f0672c2c9 -r 9d2a9a161cb2 ChangeLog --- a/ChangeLog Sun Dec 12 19:18:42 2021 -0600 +++ b/ChangeLog Tue Dec 14 12:18:43 2021 -0600 @@ -1,3 +1,8 @@ +2021-12-14 Bob Friesenhahn <[email protected]> + + * www/download.rst: Add documentation for how to validate + downloaded files. + 2021-12-12 Bob Friesenhahn <[email protected]> * version.sh: Update shared library versioning information for diff -r 5c2f0672c2c9 -r 9d2a9a161cb2 VisualMagick/installer/inc/version.isx --- a/VisualMagick/installer/inc/version.isx Sun Dec 12 19:18:42 2021 -0600 +++ b/VisualMagick/installer/inc/version.isx Tue Dec 14 12:18:43 2021 -0600 @@ -10,5 +10,5 @@ #define public MagickPackageName "GraphicsMagick" #define public MagickPackageVersion "1.4" -#define public MagickPackageVersionAddendum ".020211212" -#define public MagickPackageReleaseDate "snapshot-20211212" +#define public MagickPackageVersionAddendum ".020211214" +#define public MagickPackageReleaseDate "snapshot-20211214" diff -r 5c2f0672c2c9 -r 9d2a9a161cb2 magick/version.h --- a/magick/version.h Sun Dec 12 19:18:42 2021 -0600 +++ b/magick/version.h Tue Dec 14 12:18:43 2021 -0600 @@ -38,8 +38,8 @@ #define MagickLibVersion 0x262300 #define MagickLibVersionText "1.4" #define MagickLibVersionNumber 26,23,0 -#define MagickChangeDate "20211212" -#define MagickReleaseDate "snapshot-20211212" +#define MagickChangeDate "20211214" +#define MagickReleaseDate "snapshot-20211214" /* The MagickLibInterfaceNewest and MagickLibInterfaceOldest defines diff -r 5c2f0672c2c9 -r 9d2a9a161cb2 www/Changelog.html --- a/www/Changelog.html Sun Dec 12 19:18:42 2021 -0600 +++ b/www/Changelog.html Tue Dec 14 12:18:43 2021 -0600 @@ -35,6 +35,10 @@ <div class="document"> +<p>2021-12-14 Bob Friesenhahn <<a class="reference external" href="mailto:bfriesen%40simple.dallas.tx.us">bfriesen<span>@</span>simple<span>.</span>dallas<span>.</span>tx<span>.</span>us</a>></p> +<blockquote> +* www/download.rst: Add documentation for how to validate +downloaded files.</blockquote> <p>2021-12-12 Bob Friesenhahn <<a class="reference external" href="mailto:bfriesen%40simple.dallas.tx.us">bfriesen<span>@</span>simple<span>.</span>dallas<span>.</span>tx<span>.</span>us</a>></p> <blockquote> <p>* version.sh: Update shared library versioning information for diff -r 5c2f0672c2c9 -r 9d2a9a161cb2 www/download.html --- a/www/download.html Sun Dec 12 19:18:42 2021 -0600 +++ b/www/download.html Tue Dec 14 12:18:43 2021 -0600 @@ -38,8 +38,21 @@ <!-- -*- mode: rst -*- --> <!-- This text is in reStucturedText format, so it may look a bit odd. --> <!-- See http://docutils.sourceforge.net/rst.html for details. --> +<div class="contents local topic" id="contents"> +<ul class="simple"> +<li><a class="reference internal" href="#download-sites" id="id1">Download Sites</a></li> +<li><a class="reference internal" href="#verifying-the-download" id="id2">Verifying The Download</a><ul> +<li><a class="reference internal" href="#using-a-pgp-key" id="id3">Using a PGP key</a></li> +<li><a class="reference internal" href="#using-a-sha-1-checksum" id="id4">Using a SHA-1 checksum</a></li> +</ul> +</li> +</ul> +</div> +<div class="section" id="download-sites"> +<h1><a class="toc-backref" href="#id1">Download Sites</a></h1> <p>The source distribution of GraphicsMagick as well as pre-compiled -binaries may be downloaded from the <a class="reference external" href="http://sourceforge.net/projects/graphicsmagick/files/">SourceForge Download</a> page.</p> +binaries may be downloaded from the <a class="reference external" href="http://sourceforge.net/projects/graphicsmagick/files/">SourceForge Download</a> page. +This is also where 'snapshot' distribution archives may be found.</p> <p>Until recently (December, 2021) GraphicsMagick provided its own ftp site for downloads but this has been disabled due to abusive download practices and because support for FTP has been removed from popular @@ -50,6 +63,66 @@ like to provide a GraphicsMagick mirror, please contact <a class="reference external" href="mailto:bfriesen%40graphicsmagick.org">Bob Friesenhahn</a> and we will work something out.</p> </div> +<div class="section" id="verifying-the-download"> +<h1><a class="toc-backref" href="#id2">Verifying The Download</a></h1> +<div class="section" id="using-a-pgp-key"> +<h2><a class="toc-backref" href="#id3">Using a PGP key</a></h2> +<p>GraphicsMagick is software which runs on a computer, and if its code +(source or binary code) was subtly modified (perhaps on the download +server, or modified after download), it could do almost anything! Due +to this, it is useful to verify the download before you use it.</p> +<p>Distributed packages may be verified (both for integrity and origin) +using GnuPG (gpg). GnuPG is normally provided as a package for your +operating system (often already installed), or may be downloaded from +<a class="reference external" href="https://gnupg.org/download/">https://gnupg.org/download/</a>. The installed program on your system +might be named 'gpg', 'gpg2', or 'gpg1'.</p> +<p>The signing key used (currently DSA key id +EBDFDB21B020EE8FD151A88DE301047DE1198975) may be extracted from +<a class="reference external" href="http://www.graphicsmagick.org/security.html">http://www.graphicsmagick.org/security.html</a>. If using this +approach (rather than a key server) to obtain the key, then copy the +entire block of text including the all of the "BEGIN" and "END" lines +to a file (e.g. <cite>gm-sigs.asc</cite>) and import it into your collection of +keys. For example:</p> +<pre class="literal-block"> +gpg --import gm-sigs.asc +</pre> +<p>After this, you can easily verify any GraphicsMagick distribution file +with an associated ".sig" file (requires downloading two files) by +doing this:</p> +<pre class="literal-block"> +gpg --verify GraphicsMagick-1.3.37.tar.xz.sig +</pre> +<p>and you should see output similar to:</p> +<pre class="literal-block"> +gpg: assuming signed data in 'GraphicsMagick-1.3.37.tar.xz' +gpg: Signature made Sun Dec 12 15:30:02 2021 CST +gpg: using DSA key EBDFDB21B020EE8FD151A88DE301047DE1198975 +gpg: Good signature from "Bob Friesenhahn <bfriesen@simple.dallas.tx.us>" [ultimate] +gpg: aka "Bob Friesenhahn <bfriesen@simplesystems.org>" [ultimate] +gpg: aka "Bob Friesenhahn <bfriesen@graphicsmagick.org>" [ultimate] +gpg: aka "Bob Friesenhahn <bobjfriesenhahn@gmail.com>" [ultimate] +gpg: aka "[jpeg image of size 4917]" [ultimate] +</pre> +</div> +<div class="section" id="using-a-sha-1-checksum"> +<h2><a class="toc-backref" href="#id4">Using a SHA-1 checksum</a></h2> +<p>While verifying distribution files using GnuPG is by far the most +secure way to validate a release file, you may find SHA-1 checksums in +a distribution release announcement (e.g. from the +graphicsmagick-announce list at +<a class="reference external" href="https://sourceforge.net/p/graphicsmagick/mailman/graphicsmagick-announce/">https://sourceforge.net/p/graphicsmagick/mailman/graphicsmagick-announce/</a> +which you <em>should</em> subscribe to). In this case you may do:</p> +<pre class="literal-block"> +sha1sum GraphicsMagick-1.3.37.tar.xz +</pre> +<p>and then compare the generated checksum with the checksum provided in +the release announcement. While this is much more secure than doing +nothing, it does not fully defend against forgery. If someone is able +to forge a modified release archive as well as a release announcment, +then you could be duped!</p> +</div> +</div> +</div> <hr class="docutils"> <div class="document"> diff -r 5c2f0672c2c9 -r 9d2a9a161cb2 www/download.rst --- a/www/download.rst Sun Dec 12 19:18:42 2021 -0600 +++ b/www/download.rst Tue Dec 14 12:18:43 2021 -0600 @@ -12,8 +12,12 @@ .. contents:: :local: +Download Sites +============== + The source distribution of GraphicsMagick as well as pre-compiled binaries may be downloaded from the `SourceForge Download`_ page. +This is also where 'snapshot' distribution archives may be found. Until recently (December, 2021) GraphicsMagick provided its own ftp site for downloads but this has been disabled due to abusive download @@ -24,3 +28,65 @@ administrator of a high-bandwidth ftp or https mirror site and would like to provide a GraphicsMagick mirror, please contact `Bob Friesenhahn`_ and we will work something out. + +Verifying The Download +====================== + +Using a PGP key +--------------- + +GraphicsMagick is software which runs on a computer, and if its code +(source or binary code) was subtly modified (perhaps on the download +server, or modified after download), it could do almost anything! Due +to this, it is useful to verify the download before you use it. + +Distributed packages may be verified (both for integrity and origin) +using GnuPG (gpg). GnuPG is normally provided as a package for your +operating system (often already installed), or may be downloaded from +https://gnupg.org/download/. The installed program on your system +might be named 'gpg', 'gpg2', or 'gpg1'. + +The signing key used (currently DSA key id +EBDFDB21B020EE8FD151A88DE301047DE1198975) may be extracted from +http://www.graphicsmagick.org/security.html. If using this +approach (rather than a key server) to obtain the key, then copy the +entire block of text including the all of the "BEGIN" and "END" lines +to a file (e.g. `gm-sigs.asc`) and import it into your collection of +keys. For example:: + + gpg --import gm-sigs.asc + +After this, you can easily verify any GraphicsMagick distribution file +with an associated ".sig" file (requires downloading two files) by +doing this:: + + gpg --verify GraphicsMagick-1.3.37.tar.xz.sig + +and you should see output similar to:: + + gpg: assuming signed data in 'GraphicsMagick-1.3.37.tar.xz' + gpg: Signature made Sun Dec 12 15:30:02 2021 CST + gpg: using DSA key EBDFDB21B020EE8FD151A88DE301047DE1198975 + gpg: Good signature from "Bob Friesenhahn <[email protected]>" [ultimate] + gpg: aka "Bob Friesenhahn <[email protected]>" [ultimate] + gpg: aka "Bob Friesenhahn <[email protected]>" [ultimate] + gpg: aka "Bob Friesenhahn <[email protected]>" [ultimate] + gpg: aka "[jpeg image of size 4917]" [ultimate] + +Using a SHA-1 checksum +---------------------- + +While verifying distribution files using GnuPG is by far the most +secure way to validate a release file, you may find SHA-1 checksums in +a distribution release announcement (e.g. from the +graphicsmagick-announce list at +https://sourceforge.net/p/graphicsmagick/mailman/graphicsmagick-announce/ +which you *should* subscribe to). In this case you may do:: + + sha1sum GraphicsMagick-1.3.37.tar.xz + +and then compare the generated checksum with the checksum provided in +the release announcement. While this is much more secure than doing +nothing, it does not fully defend against forgery. If someone is able +to forge a modified release archive as well as a release announcment, +then you could be duped! diff -r 5c2f0672c2c9 -r 9d2a9a161cb2 www/security.html --- a/www/security.html Sun Dec 12 19:18:42 2021 -0600 +++ b/www/security.html Tue Dec 14 12:18:43 2021 -0600 @@ -160,8 +160,8 @@ <div class="section" id="pgp-public-key"> <h1>PGP Public Key</h1> <p>The following PGP public key (belonging to Bob Friesenhahn) is used to -sign release files on the ftp site and may be used for private -correspondence:</p> +sign release files (there is an associated .sig file) and may be used +for private correspondence:</p> <pre class="literal-block"> -----BEGIN PGP PUBLIC KEY BLOCK----- diff -r 5c2f0672c2c9 -r 9d2a9a161cb2 www/security.rst --- a/www/security.rst Sun Dec 12 19:18:42 2021 -0600 +++ b/www/security.rst Tue Dec 14 12:18:43 2021 -0600 @@ -151,8 +151,8 @@ -------------- The following PGP public key (belonging to Bob Friesenhahn) is used to -sign release files on the ftp site and may be used for private -correspondence:: +sign release files (there is an associated .sig file) and may be used +for private correspondence:: -----BEGIN PGP PUBLIC KEY BLOCK-----