17 * COMPONENT_SIG_URL is the URL where the PGP signature for $(COMPONENT_ARCHIVE) |
17 * COMPONENT_SIG_URL is the URL where the PGP signature for $(COMPONENT_ARCHIVE) |
18 can be found. This can be used in addition to the hash in |
18 can be found. This can be used in addition to the hash in |
19 $(COMPONENT_ARCHIVE_HASH) to verify the correctness of the archive. If |
19 $(COMPONENT_ARCHIVE_HASH) to verify the correctness of the archive. If |
20 COMPONENT_SIG_URL is present, then COMPONENT_ARCHIVE_HASH needn't be, but its |
20 COMPONENT_SIG_URL is present, then COMPONENT_ARCHIVE_HASH needn't be, but its |
21 presence is strongly encouraged to ensure that the archive contents don't |
21 presence is strongly encouraged to ensure that the archive contents don't |
22 change silently. If the signature results in a new key being added to |
22 change silently. Note that when merging, because |
23 tools/.gnupg/pubring.pgp, then as part of your code review, please show the |
|
24 diffs of the text version of the file by running |
|
25 gpg2 --homedir $WS/tools/.gnupg --fingerprint |
|
26 both before and after the change. Note that when merging, because |
|
27 $WS/tools/.gnupg/pubring.gpg is a binary file, you will have to choose |
23 $WS/tools/.gnupg/pubring.gpg is a binary file, you will have to choose |
28 the parent or child version. Pick one, then run: |
24 the parent or child version. Pick one, then run: |
29 for cset in $(hg log -r 'parents()' -T '{node} '); do |
25 for cset in $(hg log -r 'parents()' -T '{node} '); do |
30 hg cat -r $cset $WS/tools/.gnupg/pubring.gpg | \ |
26 hg cat -r $cset $WS/tools/.gnupg/pubring.gpg | \ |
31 gpg2 --homedir=$WS/tools/.gnupg --import; |
27 gpg2 --homedir=$WS/tools/.gnupg --import; |