Skip to content

Commit ab43de2

Browse files
committed
chore: added arkanoide signature in manifest of releases
1 parent efc0f31 commit ab43de2

File tree

2 files changed

+11
-41
lines changed

2 files changed

+11
-41
lines changed

CHANGELOG.md

Lines changed: 0 additions & 36 deletions
This file was deleted.

cliff.toml

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,20 @@ body = """
1313
In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:
1414
```bash
1515
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/negrunch.asc | gpg --import
16+
curl https://raw.githubusercontent.com/MostroP2P/mostro/main/keys/arkanoider.asc | gpg --import
1617
```
17-
Once you have the required PGP keys, you can verify the release (assuming manifest.txt.sig and manifest.txt are in the current directory) with:
18+
Once you have the required PGP keys, you can verify the release (assuming manifest.txt.sig.negrunch, manifest.txt.sig.arkanoider and manifest.txt are in the current directory) with:
1819
```bash
19-
gpg --verify manifest.txt.sig manifest.txt
20+
gpg --verify manifest.txt.sig.negrunch manifest.txt
21+
gpg --verify manifest.txt.sig.arkanoider manifest.txt
2022
21-
gpg: Firmado el jue 03 ago 2023 15:07:05 -03
22-
gpg: usando RSA clave 1E41631D137BA2ADE55344F73852B843679AD6F0
23-
gpg: Firma correcta de "Francisco Calderón <[email protected]>" [absoluta]
23+
gpg: Signature made fri 10 oct 2025 11:28:03 -03
24+
gpg: using RSA key 1E41631D137BA2ADE55344F73852B843679AD6F0
25+
gpg: Good signature from "Francisco Calderón <[email protected]>" [ultimate]
26+
27+
gpg: Signature made fri 10 oct 2025 11:28:03 -03
28+
gpg: using RSA key 2E986CA1C5E7EA1635CD059C4989CC7415A43AEC
29+
gpg: Good signature from "Arkanoider <[email protected]>" [ultimate]
2430
2531
```
2632
That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with `shasum -a 256 <filename>`, compare it with the corresponding one in the manifest file, and ensure they match exactly.

0 commit comments

Comments
 (0)