docs+scripts: switch to detached signatures

Due to a misunderstanding of how the gpg command line options work, we
didn't actually create detached signatures because the --clear-sign
flag would overwrite that. We update our verification script to now only
download the detached signatures and verify them against the main
manifest file.
We also update the signing instructions.
This commit is contained in:
Oliver Gugger committed 2021-02-15 10:33:20 +01:00
1 parent 132d23c964
commit 99ba272822
3 files changed
+42 -37

No files matched your search

+7 -9
View File
@@ -99,11 +99,11 @@ script in the image that can be called (before starting the container for
example):
```shell
$ docker pull lightninglabs/lnd:v0.12.0-beta
$ docker run --rm --entrypoint="" lightninglabs/lnd:v0.12.0-beta /verify-install.sh
$ OK=$?
$ if [ "$OK" -ne "0" ]; then echo "Verification failed!"; exit 1; done
$ docker run lightninglabs/lnd [command-line options]
⛰ docker pull lightninglabs/lnd:v0.12.0-beta
⛰ docker run --rm --entrypoint="" lightninglabs/lnd:v0.12.0-beta /verify-install.sh
⛰ OK=$?
⛰ if [ "$OK" -ne "0" ]; then echo "Verification failed!"; exit 1; done
⛰ docker run lightninglabs/lnd [command-line options]
```
# Signing an Existing Manifest File
@@ -121,8 +121,6 @@ signature during signing.
Assuming `USERNAME` is your current nick as a developer, then the following
command will generate a proper signature:
```shell
⛰ gpg --detach-sig --output manifest-USERNAME-TAG.sig manifest-TAG.txt
```
gpg --detach-sig --output manifest-USERNAME-TAG.txt.asc --clear-sign manifest-TAG.txt
```