Skip to content

Update download signature verification with new builder keys location #957

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

Update download signature verification with new builder keys location #957

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 4 additions & 6 deletions _includes/templates/download.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,13 +16,11 @@
{% capture SHORT_BUILDER_KEY %}
{{example_builder_key | slice: 0, 4}} {{ example_builder_key | slice: 4, 4 }}..
.{% endcapture %}
{% capture BUILDER_KEYS_TXT_URL %}{{page.builder_keys_url}}/keys.txt{% endcapture %}

{% capture OBTAIN_RELEASE_KEY %}
{{page.obtain_release_key |
replace: '$(BUILDER_KEYS_URL)', page.builder_keys_url |
replace: '$(EXAMPLE_BUILDERS_LINE)', page.example_builders_line |
replace: '$(BUILDER_KEYS_TXT_URL)', BUILDER_KEYS_TXT_URL}}
replace: '$(EXAMPLE_BUILDER_KEY_FILE)', page.example_builder_key_file}}
{% endcapture %}

{% assign GPG_DOWNLOAD_URL = "https://www.gnupg.org/download/index.en.html#binary" %}
Expand Down Expand Up @@ -157,7 +155,7 @@ <h2 style="text-align: center" id="{{page.verify_download | slugify}}">{{page.ve

<li>{{OBTAIN_RELEASE_KEY}}

<pre class="highlight"><code>{{GPG}}{{site.strings.gpg_keyserver}} --recv-keys {{example_builder_key}}</code></pre>
<pre class="highlight"><code>{{GPG}} --import {{page.example_builder_key_file}}</code></pre>

<p>{{page.release_key_obtained}}</p></li>

Expand Down Expand Up @@ -205,7 +203,7 @@ <h2 style="text-align: center" id="{{page.verify_download | slugify}}">{{page.ve

<li>{{OBTAIN_RELEASE_KEY}}

<pre class="highlight"><code>gpg{{site.strings.gpg_keyserver}} --recv-keys {{example_builder_key}}</code></pre>
<pre class="highlight"><code>gpg --import {{page.example_builder_key_file}}</code></pre>

<p>{{page.release_key_obtained}}</p></li>

Expand Down Expand Up @@ -247,7 +245,7 @@ <h2 style="text-align: center" id="{{page.verify_download | slugify}}">{{page.ve

<li>{{OBTAIN_RELEASE_KEY}}

<pre class="highlight"><code>gpg{{site.strings.gpg_keyserver}} --recv-keys {{example_builder_key}}</code></pre>
<pre class="highlight"><code>gpg --import {{page.example_builder_key_file}}</code></pre>

<p>{{page.release_key_obtained}}</p></li>

Expand Down
13 changes: 7 additions & 6 deletions _posts/en/pages/2017-01-01-download.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,19 +80,20 @@ verify_download_checksum: "Verify that the checksum of the release file is liste
checksum_warning_and_ok: 'In the output produced by the above command, you can safely ignore any warnings and failures, but you must ensure the output lists "$(SHASUMS_OK)" after the name of the release file you downloaded. For example:'

example_builders_line: "E777299FC265DD04793070EB944D35F9AC3DB76A Michael Ford (fanquake)"
builder_keys_url: "https://github.com/bitcoin/bitcoin/tree/master/contrib/builder-keys"
builder_keys_url: "https://github.com/bitcoin-core/guix.sigs/tree/main/builder-keys"
example_builder_key_file: "fanquake.gpg"

obtain_release_key: >
<p>Bitcoin releases are signed by a number of individuals, each with a unique public
key. In order to recognize the validity of signatures, you must use GPG to load these
public keys locally. You can find many developer keys listed in the <a
href='$(BUILDER_KEYS_URL)'>bitcoin/bitcoin repository</a>, which you can then load
href='$(BUILDER_KEYS_URL)'>bitcoin-core/guix.sigs repository</a>, which you can then load
into your GPG key database.</p>

<p>For example, given the <a href='$(BUILDER_KEYS_TXT_URL)'><code>
builder-keys/keys.txt</code></a> line
<code>$(EXAMPLE_BUILDERS_LINE)</code>you could load that
key using this command:</p>
<p>For example, you could load the key <a
href='$(BUILDER_KEYS_URL)/$(EXAMPLE_BUILDER_KEY_FILE)'><code>
builder-keys/$(EXAMPLE_BUILDER_KEY_FILE)</code></a> by downloading the file as <code>
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Being vague on purpose about downloading the file since i don't think a curl -sS https://raw.githubusercontent.com/bitcoin-core/guix.sigs/main/builder-keys/fanquake.gpg | gpg --import would be portable to Windows. And downloading a file should be straightforward enough?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think using the raw... link here instead of the github file viewing UI does make it a bit easier for users. From the raw URL I can right click (in firefox/macOS) and "save as..." but currently the page you see when you click here has no explicit download button.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Screen Shot 2023-05-08 at 4 26 34 PM

Huh never mind! Did GH just change this interface? Raw copy and download buttons are, in fact, just fine right there.

$(EXAMPLE_BUILDER_KEY_FILE)</code> and using this command:</p>

choosing_builders: >
It is recommended that you choose a few individuals from this list who you find
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This section needs an update as well, there is no more README in the specified link.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Similarly, macOS step 10 (gpg_trust_warning) is not entirely clear, or it could just be my version of gpg...

Current:

Screen Shot 2023-03-27 at 1 27 11 PM

Actual (example, one good one bad):
Screen Shot 2023-03-27 at 1 27 56 PM

Expand Down