GraphicsMagick: Produce both ".asc" and ".bin" GPG signature fil...
GraphicsMagick Commits <[email protected]>
| Newsgroups | gmane.comp.video.graphicsmagick.cvs |
|---|---|
| Message-ID | <mailman.1953.1660663754.11362.graphicsmagick-commit@lists.sourceforge.net> |
changeset cbd0ea09bcb1 in /hg/GraphicsMagick details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=cbd0ea09bcb1 summary: Produce both ".asc" and ".bin" GPG signature files when signing distribution files. diffstat: ChangeLog | 6 ++++++ Makefile.am | 11 ++++++++--- Makefile.in | 11 ++++++++--- www/download.html | 26 +++++++++++--------------- www/download.rst | 28 ++++++++++++---------------- 5 files changed, 45 insertions(+), 37 deletions(-) diffs (251 lines): diff -r 6983b5d4a18f -r cbd0ea09bcb1 ChangeLog --- a/ChangeLog Mon Aug 15 14:17:25 2022 -0500 +++ b/ChangeLog Tue Aug 16 10:28:59 2022 -0500 @@ -1,3 +1,9 @@ +2022-08-16 Bob Friesenhahn <[email protected]> + + * Makefile.am: Some people prefer GPG signature files in ASCII + armored ".asc" format rather than the OpenPGP binary ".bin" + format, so produce both. + 2022-08-15 Bob Friesenhahn <[email protected]> * Fix UTF-8 encoding errors in some text and source files. A few diff -r 6983b5d4a18f -r cbd0ea09bcb1 Makefile.am --- a/Makefile.am Mon Aug 15 14:17:25 2022 -0500 +++ b/Makefile.am Tue Aug 16 10:28:59 2022 -0500 @@ -387,16 +387,18 @@ # # The arguments to the script are the original path names of the files to distribute. SNAPSHOT_DIST_ARCHIVES=$(DIST_ARCHIVES) $(DIST_WINDOWS_SRC_7ZIP) $(DIST_ARCHIVE_SRPM) +# FIXME: Can use gpg --enarmor to produce asc files from sig files snapshot: distcheck $(MAKE) $(DIST_ARCHIVE_SRPM) $(MAKE) $(DIST_WINDOWS_SRC_7ZIP) for file in $(SNAPSHOT_DIST_ARCHIVES) ; do \ - rm -f $${file}.sig ; \ + rm -f $${file}.asc $${file}.sig ; \ $(GPG) --output $${file}.sig --detach-sig $${file} ; \ + $(GPG) --output $${file}.asc --enarmor $${file}.sig ; \ sha256sum $${file} > $${file}.sum ; \ done SRCDIR=$(SRCDIR) $(GRAPHICSMAGICK_SNAPSHOT_COPY) $(SNAPSHOT_DIST_ARCHIVES) \ - `for f in $(SNAPSHOT_DIST_ARCHIVES) ; do printf "%s.sig " $$f ; done` \ + `for f in $(SNAPSHOT_DIST_ARCHIVES) ; do printf "%s.asc %s.sig " $$f $$f ; done` \ $(top_srcdir)/ChangeLog $(top_srcdir)/www/Changelog.html else @@ -408,6 +410,7 @@ $(MAKE) $(DIST_WINDOWS_SRC_7ZIP) for file in $(SNAPSHOT_DIST_ARCHIVES) ; do \ $(GPG) --output $${file}.sig --detach-sig $${file} ; \ + $(GPG) --output $${file}.asc --enarmor $${file}.sig ; \ sha256sum $${file} > $${file}.sum ; \ done $(RM) $(SNAPSHOT_DIRECTORY)/$(PACKAGE_NAME)-*.tar.* @@ -415,6 +418,7 @@ mv $(SNAPSHOT_DIST_ARCHIVES) $(SNAPSHOT_DIRECTORY)/ for file in $(SNAPSHOT_DIST_ARCHIVES) ; do \ mv $${file}.sig $(SNAPSHOT_DIRECTORY)/ ; \ + mv $${file}.asc $(SNAPSHOT_DIRECTORY)/ ; \ done cp $(top_srcdir)/ChangeLog $(SNAPSHOT_DIRECTORY)/ChangeLog.txt cp $(top_srcdir)/www/Changelog.html $(SNAPSHOT_DIRECTORY)/ChangeLog.html @@ -468,7 +472,8 @@ release: distcheck $(MAKE) $(DIST_WINDOWS_SRC_7ZIP) for file in $(DIST_ARCHIVES) $(DIST_WINDOWS_SRC_7ZIP) ; do \ - rm -f $${file}.sig ; \ + rm -f $${file}.asc $${file}.sig ; \ $(GPG) --output $${file}.sig --detach-sig $${file} ; \ + $(GPG) --output $${file}.asc --enarmor $${file}.sig ; \ sha256sum $${file} > $${file}.sum ; \ done diff -r 6983b5d4a18f -r cbd0ea09bcb1 Makefile.in --- a/Makefile.in Mon Aug 15 14:17:25 2022 -0500 +++ b/Makefile.in Tue Aug 16 10:28:59 2022 -0500 @@ -11423,22 +11423,25 @@ dist-zstd: distdir tardir=$(distdir) && $(am__tar) | ZSTD_CLEVEL=$${ZSTD_CLEVEL-22} zstd --ultra -c >$(distdir).tar.zst $(am__post_remove_distdir) +# FIXME: Can use gpg --enarmor to produce asc files from sig files @HasGRAPHICSMAGICK_SNAPSHOT_COPY_TRUE@snapshot: distcheck @HasGRAPHICSMAGICK_SNAPSHOT_COPY_TRUE@ $(MAKE) $(DIST_ARCHIVE_SRPM) @HasGRAPHICSMAGICK_SNAPSHOT_COPY_TRUE@ $(MAKE) $(DIST_WINDOWS_SRC_7ZIP) @HasGRAPHICSMAGICK_SNAPSHOT_COPY_TRUE@ for file in $(SNAPSHOT_DIST_ARCHIVES) ; do \ -@HasGRAPHICSMAGICK_SNAPSHOT_COPY_TRUE@ rm -f $${file}.sig ; \ +@HasGRAPHICSMAGICK_SNAPSHOT_COPY_TRUE@ rm -f $${file}.asc $${file}.sig ; \ @HasGRAPHICSMAGICK_SNAPSHOT_COPY_TRUE@ $(GPG) --output $${file}.sig --detach-sig $${file} ; \ +@HasGRAPHICSMAGICK_SNAPSHOT_COPY_TRUE@ $(GPG) --output $${file}.asc --enarmor $${file}.sig ; \ @HasGRAPHICSMAGICK_SNAPSHOT_COPY_TRUE@ sha256sum $${file} > $${file}.sum ; \ @HasGRAPHICSMAGICK_SNAPSHOT_COPY_TRUE@ done @HasGRAPHICSMAGICK_SNAPSHOT_COPY_TRUE@ SRCDIR=$(SRCDIR) $(GRAPHICSMAGICK_SNAPSHOT_COPY) $(SNAPSHOT_DIST_ARCHIVES) \ -@HasGRAPHICSMAGICK_SNAPSHOT_COPY_TRUE@ `for f in $(SNAPSHOT_DIST_ARCHIVES) ; do printf "%s.sig " $$f ; done` \ +@HasGRAPHICSMAGICK_SNAPSHOT_COPY_TRUE@ `for f in $(SNAPSHOT_DIST_ARCHIVES) ; do printf "%s.asc %s.sig " $$f $$f ; done` \ @HasGRAPHICSMAGICK_SNAPSHOT_COPY_TRUE@ $(top_srcdir)/ChangeLog $(top_srcdir)/www/Changelog.html @HasGRAPHICSMAGICK_SNAPSHOT_COPY_FALSE@snapshot: distcheck @HasGRAPHICSMAGICK_SNAPSHOT_COPY_FALSE@ $(MAKE) $(DIST_ARCHIVE_SRPM) @HasGRAPHICSMAGICK_SNAPSHOT_COPY_FALSE@ $(MAKE) $(DIST_WINDOWS_SRC_7ZIP) @HasGRAPHICSMAGICK_SNAPSHOT_COPY_FALSE@ for file in $(SNAPSHOT_DIST_ARCHIVES) ; do \ @HasGRAPHICSMAGICK_SNAPSHOT_COPY_FALSE@ $(GPG) --output $${file}.sig --detach-sig $${file} ; \ +@HasGRAPHICSMAGICK_SNAPSHOT_COPY_FALSE@ $(GPG) --output $${file}.asc --enarmor $${file}.sig ; \ @HasGRAPHICSMAGICK_SNAPSHOT_COPY_FALSE@ sha256sum $${file} > $${file}.sum ; \ @HasGRAPHICSMAGICK_SNAPSHOT_COPY_FALSE@ done @HasGRAPHICSMAGICK_SNAPSHOT_COPY_FALSE@ $(RM) $(SNAPSHOT_DIRECTORY)/$(PACKAGE_NAME)-*.tar.* @@ -11446,6 +11449,7 @@ @HasGRAPHICSMAGICK_SNAPSHOT_COPY_FALSE@ mv $(SNAPSHOT_DIST_ARCHIVES) $(SNAPSHOT_DIRECTORY)/ @HasGRAPHICSMAGICK_SNAPSHOT_COPY_FALSE@ for file in $(SNAPSHOT_DIST_ARCHIVES) ; do \ @HasGRAPHICSMAGICK_SNAPSHOT_COPY_FALSE@ mv $${file}.sig $(SNAPSHOT_DIRECTORY)/ ; \ +@HasGRAPHICSMAGICK_SNAPSHOT_COPY_FALSE@ mv $${file}.asc $(SNAPSHOT_DIRECTORY)/ ; \ @HasGRAPHICSMAGICK_SNAPSHOT_COPY_FALSE@ done @HasGRAPHICSMAGICK_SNAPSHOT_COPY_FALSE@ cp $(top_srcdir)/ChangeLog $(SNAPSHOT_DIRECTORY)/ChangeLog.txt @HasGRAPHICSMAGICK_SNAPSHOT_COPY_FALSE@ cp $(top_srcdir)/www/Changelog.html $(SNAPSHOT_DIRECTORY)/ChangeLog.html @@ -11473,8 +11477,9 @@ release: distcheck $(MAKE) $(DIST_WINDOWS_SRC_7ZIP) for file in $(DIST_ARCHIVES) $(DIST_WINDOWS_SRC_7ZIP) ; do \ - rm -f $${file}.sig ; \ + rm -f $${file}.asc $${file}.sig ; \ $(GPG) --output $${file}.sig --detach-sig $${file} ; \ + $(GPG) --output $${file}.asc --enarmor $${file}.sig ; \ sha256sum $${file} > $${file}.sum ; \ done diff -r 6983b5d4a18f -r cbd0ea09bcb1 www/download.html --- a/www/download.html Mon Aug 15 14:17:25 2022 -0500 +++ b/www/download.html Tue Aug 16 10:28:59 2022 -0500 @@ -51,18 +51,8 @@ <div class="section" id="download-sites"> <h1><a class="toc-backref" href="#id1">Download Sites</a></h1> <p>The source distribution of GraphicsMagick as well as pre-compiled -binaries may be downloaded from the <a class="reference external" href="http://sourceforge.net/projects/graphicsmagick/files/">SourceForge Download</a> page. +binaries may be downloaded from the <a class="reference external" href="https://sourceforge.net/projects/graphicsmagick/files/">SourceForge Download</a> page. This is also where 'snapshot' distribution archives may be found.</p> -<p>Until recently (December, 2021) GraphicsMagick provided its own ftp -site for downloads but this has been disabled due to abusive download -practices (by using it as the primary download site) and because -support for FTP has been removed from popular browsers. This is -unfortunate since the same site also provided PNG-related files and a -libtiff mirror. The ftp site directory tree continues to exist and -will be maintained. If you are an administrator of a high-bandwidth -ftp or https mirror site and would like to provide a GraphicsMagick -mirror, please contact <a class="reference external" href="mailto:bfriesen%40graphicsmagick.org">Bob Friesenhahn</a> and we will work something -out.</p> </div> <div class="section" id="verifying-the-download"> <h1><a class="toc-backref" href="#id2">Verifying The Download</a></h1> @@ -71,7 +61,9 @@ <p>GraphicsMagick is software which runs on a computer, and if its code (source or binary code) was subtly modified (perhaps on the download server, or modified after download), it could do almost anything! Due -to this, it is useful to verify the download before you use it.</p> +to this, it is useful to verify the download before you use it. This +is especially important if you are preparing binaries for others to +use.</p> <p>Distributed packages may be verified (both for integrity and origin) using GnuPG (gpg). GnuPG is normally provided as a package for your operating system (often already installed), or may be downloaded from @@ -89,6 +81,8 @@ <pre class="literal-block"> gpg --recv-keys EBDFDB21B020EE8FD151A88DE301047DE1198975 </pre> +<p>however, there are known dangers to your keystore if the keys on the +public key server have been spammed.</p> <p>If extracting the key from the <a class="reference external" href="http://www.graphicsmagick.org/security.html">http://www.graphicsmagick.org/security.html</a> web page, then copy the entire block of text including the all of the "BEGIN" and "END" lines @@ -100,8 +94,10 @@ gpg --import gm-sigs.asc </pre> <p>After importing the key, you can easily verify any GraphicsMagick -distribution file with an associated ".sig" file (requires downloading -two files) by doing this:</p> +distribution file with an associated ".sig" (binary OpenPGP format +signature) or ".asc" (ASCII armored format signature) file. The +distribution file and a signature file must be +downloaded. Verification is performed by doing this:</p> <pre class="literal-block"> gpg --verify GraphicsMagick-1.3.37.tar.xz.sig </pre> @@ -129,7 +125,7 @@ <pre class="literal-block"> sha256sum GraphicsMagick-1.3.37.tar.xz </pre> -<p>and this for a SHA-1 checksum:</p> +<p>and this for a SHA-1 (legacy) checksum:</p> <pre class="literal-block"> sha1sum GraphicsMagick-1.3.37.tar.xz </pre> diff -r 6983b5d4a18f -r cbd0ea09bcb1 www/download.rst --- a/www/download.rst Mon Aug 15 14:17:25 2022 -0500 +++ b/www/download.rst Tue Aug 16 10:28:59 2022 -0500 @@ -7,7 +7,7 @@ ======================= .. _Bob Friesenhahn : mailto:[email protected] -.. _SourceForge Download : http://sourceforge.net/projects/graphicsmagick/files/ +.. _SourceForge Download : https://sourceforge.net/projects/graphicsmagick/files/ .. contents:: :local: @@ -19,17 +19,6 @@ binaries may be downloaded from the `SourceForge Download`_ page. This is also where 'snapshot' distribution archives may be found. -Until recently (December, 2021) GraphicsMagick provided its own ftp -site for downloads but this has been disabled due to abusive download -practices (by using it as the primary download site) and because -support for FTP has been removed from popular browsers. This is -unfortunate since the same site also provided PNG-related files and a -libtiff mirror. The ftp site directory tree continues to exist and -will be maintained. If you are an administrator of a high-bandwidth -ftp or https mirror site and would like to provide a GraphicsMagick -mirror, please contact `Bob Friesenhahn`_ and we will work something -out. - Verifying The Download ====================== @@ -39,7 +28,9 @@ GraphicsMagick is software which runs on a computer, and if its code (source or binary code) was subtly modified (perhaps on the download server, or modified after download), it could do almost anything! Due -to this, it is useful to verify the download before you use it. +to this, it is useful to verify the download before you use it. This +is especially important if you are preparing binaries for others to +use. Distributed packages may be verified (both for integrity and origin) using GnuPG (gpg). GnuPG is normally provided as a package for your @@ -61,6 +52,9 @@ gpg --recv-keys EBDFDB21B020EE8FD151A88DE301047DE1198975 +however, there are known dangers to your keystore if the keys on the +public key server have been spammed. + If extracting the key from the http://www.graphicsmagick.org/security.html web page, then copy the entire block of text including the all of the "BEGIN" and "END" lines @@ -73,8 +67,10 @@ gpg --import gm-sigs.asc After importing the key, you can easily verify any GraphicsMagick -distribution file with an associated ".sig" file (requires downloading -two files) by doing this:: +distribution file with an associated ".sig" (binary OpenPGP format +signature) or ".asc" (ASCII armored format signature) file. The +distribution file and a signature file must be +downloaded. Verification is performed by doing this:: gpg --verify GraphicsMagick-1.3.37.tar.xz.sig @@ -102,7 +98,7 @@ sha256sum GraphicsMagick-1.3.37.tar.xz -and this for a SHA-1 checksum:: +and this for a SHA-1 (legacy) checksum:: sha1sum GraphicsMagick-1.3.37.tar.xz