Commit 082e50d
doc: update the instruction on how to verify releases
PR-URL: #59113
Fixes: #58904
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Ruy Adorno <ruy@vlt.sh>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>1 parent 19a6636 commit 082e50d
1 file changed
Lines changed: 19 additions & 23 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -95,37 +95,27 @@ _docs_ subdirectory. Version-specific documentation is also at | |||
| 95 | 95 | ||
| 96 | 96 | ### Verifying binaries | |
| 97 | 97 | ||
| 98 | - Download directories contain a `SHASUMS256.txt` file with SHA checksums for the | ||
| 99 | - files. | ||
| 98 | + Download directories contain a `SHASUMS256.txt.asc` file with SHA checksums for the | ||
| 99 | + files and the releaser PGP signature. | ||
| 100 | 100 | ||
| 101 | - To download `SHASUMS256.txt` using `curl`: | ||
| 101 | + You can get a trusted keyring from nodejs/release-keys, e.g. using `curl`: | ||
| 102 | 102 | ||
| 103 | 103 | ```bash | |
| 104 | - curl -O https://nodejs.org/dist/vx.y.z/SHASUMS256.txt | ||
| 104 | + curl -fsLo "/path/to/nodejs-keyring.kbx" "https://github.com/nodejs/release-keys/raw/HEAD/gpg/pubring.kbx" | ||
| 105 | 105 | ``` | |
| 106 | 106 | ||
| 107 | - To check that downloaded files match the checksum, use `sha256sum`: | ||
| 107 | + Alternatively, you can import the releaser keys in your default keyring, see | ||
| 108 | + [Release keys](#release-keys) for commands to how to do that. | ||
| 108 | 109 | ||
| 109 | - ```bash | ||
| 110 | - sha256sum -c SHASUMS256.txt --ignore-missing | ||
| 111 | - ``` | ||
| 112 | - | ||
| 113 | - For Current and LTS, the GPG detached signature of `SHASUMS256.txt` is in | ||
| 114 | - `SHASUMS256.txt.sig`. You can use it with `gpg` to verify the integrity of | ||
| 115 | - `SHASUMS256.txt`. You will first need to import | ||
| 116 | - [the GPG keys of individuals authorized to create releases](#release-keys). | ||
| 117 | - | ||
| 118 | - See [Release keys](#release-keys) for commands to import active release keys. | ||
| 119 | - | ||
| 120 | - Next, download the `SHASUMS256.txt.sig` for the release: | ||
| 110 | + Then, you can verify the files you've downloaded locally | ||
| 111 | + (if you're using your default keyring, pass `--keyring="${GNUPGHOME:-~/.gnupg}/pubring.kbx"`): | ||
| 121 | 112 | ||
| 122 | 113 | ```bash | |
| 123 | - curl -O https://nodejs.org/dist/vx.y.z/SHASUMS256.txt.sig | ||
| 114 | + curl -fsO "https://nodejs.org/dist/${VERSION}/SHASUMS256.txt.asc" \ | ||
| 115 | + && gpgv --keyring="/path/to/nodejs-keyring.kbx" --output SHASUMS256.txt < SHASUMS256.txt.asc \ | ||
| 116 | + && shasum --check SHASUMS256.txt --ignore-missing | ||
| 124 | 117 | ``` | |
| 125 | 118 | ||
| 126 | - Then use `gpg --verify SHASUMS256.txt.sig SHASUMS256.txt` to verify | ||
| 127 | - the file's signature. | ||
| 128 | - | ||
| 129 | 119 | ## Building Node.js | |
| 130 | 120 | ||
| 131 | 121 | See [BUILDING.md](BUILDING.md) for instructions on how to build Node.js from | |
@@ -802,8 +792,11 @@ Primary GPG keys for Node.js Releasers (some Releasers sign with subkeys): | |||
| 802 | 792 | * **Ulises Gascón** <<ulisesgascongonzalez@gmail.com>> | |
| 803 | 793 | `A363A499291CBBC940DD62E41F10027AF002F8B0` | |
| 804 | 794 | ||
| 805 | - To import the full set of trusted release keys (including subkeys possibly used | ||
| 806 | - to sign releases): | ||
| 795 | + You can use the keyring the project maintains at | ||
| 796 | + <https://github.com/nodejs/release-keys/raw/refs/heads/main/gpg-only-active-keys/pubring.kbx>. | ||
| 797 | + Alternatively, you can import them from a public key server. Have in mind that | ||
| 798 | + the project cannot guarantee the availability of the server nor the keys on | ||
| 799 | + that server. | ||
| 807 | 800 | ||
| 808 | 801 | ```bash | |
| 809 | 802 | gpg --keyserver hkps://keys.openpgp.org --recv-keys 5BE8A3F6C8A5C01D106C0AD820B1A390B168D356 # Antoine du Hamel | |
@@ -863,6 +856,9 @@ verify a downloaded file. | |||
| 863 | 856 | * **Timothy J Fontaine** <<tjfontaine@gmail.com>> | |
| 864 | 857 | `7937DFD2AB06298B2293C3187D33FF9D0246406D` | |
| 865 | 858 | ||
| 859 | + The project maintains a keyring able to verify all past releases of Node.js at | ||
| 860 | + <https://github.com/nodejs/release-keys/raw/refs/heads/main/gpg/pubring.kbx>. | ||
| 861 | + | ||
| 866 | 862 | </details> | |
| 867 | 863 | ||
| 868 | 864 | ### Security release stewards | |
0 commit comments