subversion-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Julian Foad <julianf...@btopenworld.com>
Subject Re: issue 4587: Verifying multiple OpenPGP signatures on a release
Date Thu, 13 Aug 2015 12:08:34 GMT
Andreas Stieger wrote:
> The following splits and verifies all signatures:
> csplit --elide-empty-files --prefix=sig --suffix-format=%0d2.asc  subversion-1.9.0.tar.bz2.asc
'/^-----BEGIN PGP SIGNATURE-----$/' '{*}'
> for X in sig*.asc; do gpg --verify $X subversion-1.9.0.tar.bz2; done

Yes, that works, even though you seem to have a typo: you probably
meant --suffix-format=%02d.asc.

However, a good solution would be easy and reliable for novice users,
and would work on a wide range of operating systems.

> The same could be done in awk.

Yes.

> In 2013 gpg was noted to not support multiple signatures if the signing keys differ in
type/digest:
> http://www.eyrie.org/~eagle/journal/2013-01/011.html

Yes, I noted that in the issue, and I pointed to a thread where that
was briefly discussed.

- Julian

Mime
View raw message