GraphicsMagick: www/download.rst: More properly describe how to ...

changeset 0573a8abe875 in /hg/GraphicsMagick
details: http://hg.GraphicsMagick.org/hg/GraphicsMagick?cmd=changeset;node=0573a8abe875
summary: www/download.rst: More properly describe how to use 'gpg --verify'

diffstat:

 ChangeLog          |  5 +++++
 www/Changelog.html |  7 +++++++
 www/download.html  |  8 ++++----
 www/download.rst   |  8 ++++----
 4 files changed, 20 insertions(+), 8 deletions(-)

diffs (87 lines):

diff -r 8751cb9ce1bd -r 0573a8abe875 ChangeLog
--- a/ChangeLog	Sat Apr 29 11:46:13 2023 -0500
+++ b/ChangeLog	Sat Apr 29 12:00:29 2023 -0500
@@ -1,3 +1,8 @@
+2023-04-29  Bob Friesenhahn  <[email protected]>
+
+	* www/download.rst: More properly describe how to use 'gpg
+	--verify'.
+
 2023-04-29  Fojtik Jaroslav  <[email protected]>
 
 	* coders/topol.c: First attempt to make a writer.
diff -r 8751cb9ce1bd -r 0573a8abe875 www/Changelog.html
--- a/www/Changelog.html	Sat Apr 29 11:46:13 2023 -0500
+++ b/www/Changelog.html	Sat Apr 29 12:00:29 2023 -0500
@@ -37,6 +37,13 @@
 </div>
 
 <div class="document">
+<p>2023-04-29  Bob Friesenhahn  &lt;<a class="reference external" href="mailto:bfriesen&#37;&#52;&#48;simple&#46;dallas&#46;tx&#46;us">bfriesen<span>&#64;</span>simple<span>&#46;</span>dallas<span>&#46;</span>tx<span>&#46;</span>us</a>&gt;</p>
+<blockquote>
+<ul class="simple">
+<li><p>www/download.rst: More properly describe how to use 'gpg
+--verify'.</p></li>
+</ul>
+</blockquote>
 <p>2023-04-29  Fojtik Jaroslav  &lt;<a class="reference external" href="mailto:JaFojtik&#37;&#52;&#48;yandex&#46;com">JaFojtik<span>&#64;</span>yandex<span>&#46;</span>com</a>&gt;</p>
 <blockquote>
 <ul class="simple">
diff -r 8751cb9ce1bd -r 0573a8abe875 www/download.html
--- a/www/download.html	Sat Apr 29 11:46:13 2023 -0500
+++ b/www/download.html	Sat Apr 29 12:00:29 2023 -0500
@@ -155,9 +155,9 @@
 signature) or &quot;.asc&quot; (ASCII armored format signature) file.  The
 distribution file and a signature file must be
 downloaded. Verification is performed by doing this:</p>
-<pre class="literal-block">gpg --verify GraphicsMagick-1.3.37.tar.xz.sig</pre>
+<pre class="literal-block">gpg --verify GraphicsMagick-1.3.40.tar.xz.sig GraphicsMagick-1.3.40.tar.xz</pre>
 <p>and you should see output similar to:</p>
-<pre class="literal-block">gpg: assuming signed data in 'GraphicsMagick-1.3.37.tar.xz'
+<pre class="literal-block">gpg: assuming signed data in 'GraphicsMagick-1.3.40.tar.xz'
 gpg: Signature made Sun Dec 12 15:30:02 2021 CST
 gpg:                using DSA key EBDFDB21B020EE8FD151A88DE301047DE1198975
 gpg: Good signature from &quot;Bob Friesenhahn &lt;bfriesen&#64;simple.dallas.tx.us&gt;&quot; [ultimate]
@@ -175,9 +175,9 @@
 <a class="reference external" href="https://sourceforge.net/p/graphicsmagick/mailman/graphicsmagick-announce/">https://sourceforge.net/p/graphicsmagick/mailman/graphicsmagick-announce/</a>
 which you <em>should</em> subscribe to).  In this case you may do this for a
 SHA-256 checksum:</p>
-<pre class="literal-block">sha256sum GraphicsMagick-1.3.37.tar.xz</pre>
+<pre class="literal-block">sha256sum GraphicsMagick-1.3.40.tar.xz</pre>
 <p>and this for a SHA-1 (legacy) checksum:</p>
-<pre class="literal-block">sha1sum GraphicsMagick-1.3.37.tar.xz</pre>
+<pre class="literal-block">sha1sum GraphicsMagick-1.3.40.tar.xz</pre>
 <p>and then compare the generated checksum (hex format) with the checksum
 provided in the release announcement.  While this is much more secure
 than doing nothing, it does not fully defend against forgery.  If
diff -r 8751cb9ce1bd -r 0573a8abe875 www/download.rst
--- a/www/download.rst	Sat Apr 29 11:46:13 2023 -0500
+++ b/www/download.rst	Sat Apr 29 12:00:29 2023 -0500
@@ -127,11 +127,11 @@
 distribution file and a signature file must be
 downloaded. Verification is performed by doing this::
 
-  gpg --verify GraphicsMagick-1.3.37.tar.xz.sig
+  gpg --verify GraphicsMagick-1.3.40.tar.xz.sig GraphicsMagick-1.3.40.tar.xz
 
 and you should see output similar to::
 
-  gpg: assuming signed data in 'GraphicsMagick-1.3.37.tar.xz'
+  gpg: assuming signed data in 'GraphicsMagick-1.3.40.tar.xz'
   gpg: Signature made Sun Dec 12 15:30:02 2021 CST
   gpg:                using DSA key EBDFDB21B020EE8FD151A88DE301047DE1198975
   gpg: Good signature from "Bob Friesenhahn <[email protected]>" [ultimate]
@@ -151,11 +151,11 @@
 which you *should* subscribe to).  In this case you may do this for a
 SHA-256 checksum::
 
-  sha256sum GraphicsMagick-1.3.37.tar.xz
+  sha256sum GraphicsMagick-1.3.40.tar.xz
 
 and this for a SHA-1 (legacy) checksum::
 
-  sha1sum GraphicsMagick-1.3.37.tar.xz
+  sha1sum GraphicsMagick-1.3.40.tar.xz
 
 and then compare the generated checksum (hex format) with the checksum
 provided in the release announcement.  While this is much more secure