From 234c4b16856e27fb61ddb5975aa24e7e58c68e1e Mon Sep 17 00:00:00 2001 From: Gyu-Ho Lee Date: Wed, 8 Mar 2017 09:22:46 -0800 Subject: [PATCH] Documentation: sign source zip files For https://github.com/coreos/etcd/issues/7449 Signed-off-by: Gyu-Ho Lee --- Documentation/dev-internal/release.md | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/Documentation/dev-internal/release.md b/Documentation/dev-internal/release.md index 561478fa7..19153a0c3 100644 --- a/Documentation/dev-internal/release.md +++ b/Documentation/dev-internal/release.md @@ -2,7 +2,7 @@ The guide talks about how to release a new version of etcd. -The procedure includes some manual steps for sanity checking but it can probably be further scripted. Please keep this document up-to-date if making changes to the release process. +The procedure includes some manual steps for sanity checking, but it can probably be further scripted. Please keep this document up-to-date if making changes to the release process. ## Prepare release @@ -58,7 +58,7 @@ Run release script in root directory: It generates all release binaries and images under directory ./release. -## Sign binaries and images +## Sign binaries, images, and source code etcd project key must be used to sign the generated binaries and images.`$SUBKEYID` is the key ID of etcd project Yubikey. Connect the key and run `gpg2 --card-status` to get the ID. @@ -68,6 +68,15 @@ The following commands are used for public release sign: cd release for i in etcd-*{.zip,.tar.gz}; do gpg2 --default-key $SUBKEYID --armor --output ${i}.asc --detach-sign ${i}; done for i in etcd-*{.zip,.tar.gz}; do gpg2 --verify ${i}.asc ${i}; done + +# sign zipped source code files +wget https://github.com/coreos/etcd/archive/${VERSION}.zip +gpg2 --armor --default-key $SUBKEYID --output ${VERSION}.zip.asc --detach-sign ${VERSION}.zip +gpg2 --verify ${VERSION}.zip.asc ${VERSION}.zip + +wget https://github.com/coreos/etcd/archive/${VERSION}.tar.gz +gpg2 --armor --default-key $SUBKEYID --output ${VERSION}.tar.gz.asc --detach-sign ${VERSION}.tar.gz +gpg2 --verify ${VERSION}.tar.gz.asc ${VERSION}.tar.gz ``` The public key for GPG signing can be found at [CoreOS Application Signing Key](https://coreos.com/security/app-signing-key)