1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
|
#!/bin/sh
set -eu
if test "$1" = "" ; then
echo "I need a package as an argument."
exit 1
fi
PACKAGEFILE=$1
if test ! -f "$PACKAGEFILE" ; then
echo "$PACKAGEFILE is not a file."
exit 1
fi
DIGESTNAME=sha256
DIGESTOUTPUT=`gpg --print-md $DIGESTNAME $PACKAGEFILE`
RAWDIGEST=`gpg --print-md $DIGESTNAME $PACKAGEFILE | sed -e 's/^[^ ]*: //' `
# These regexes are a little fragile, but I think they work for us.
VERSION=`echo $PACKAGEFILE | sed -e 's/^[a-z\-]*//' -e 's/\.[\.a-z]*$//' `
PACKAGE=`echo $PACKAGEFILE | sed -e 's/-[0-9].*//'`
SIGFILE_UNSIGNED="$PACKAGE-$VERSION-signature"
SIGNATUREFILE="$SIGFILE_UNSIGNED.asc"
cat >$SIGFILE_UNSIGNED <<EOF
This is the signature file for "$PACKAGEFILE",
which contains version "$VERSION" of "$PACKAGE".
Here's how to check this signature.
1) Make sure that this is really a signature file, and not a forgery,
with:
"gpg --verify $SIGNATUREFILE"
The key should be one of the keys that signs the Tor release; the
official Tor website has more information on those.
If this step fails, then either you are missing the correct key, or
this signature file was not really signed by a Tor packager.
Beware!
2) Make sure that the package you wanted is indeed "$PACKAGE", and that
its version you wanted is indeed "$VERSION". If you wanted a
different package, or a different version, this signature file is
not the right one!
3) Now that you're sure you have the right signature file, make sure
that you got the right package. Check its $DIGESTNAME digest with
"gpg --print-md $DIGESTNAME $PACKAGEFILE"
The output should match this, exactly:
$DIGESTOUTPUT
Make sure that every part of the output matches: don't just check the
first few characters. If the digest does not match, you do not have
the right package file. It could even be a forgery.
Frequently asked questions:
Q: Why not just sign the package file, like you used to do?
A: GPG signatures authenticate file contents, but not file names. If
somebody gave you a renamed file with a matching renamed signature
file, the signature would still be given as "valid".
--
FILENAME: $PACKAGEFILE
PACKAGE: $PACKAGE
VERSION: $VERSION
DIGESTALG: $DIGESTNAME
DIGEST: $RAWDIGEST
EOF
gpg --clearsign $SIGFILE_UNSIGNED
|