Re: checking upstream signed release

* Lorenzo [2024-10-16 11:19]: > Hello mentors, > upstream signed last release [1], and if I download the text and save > it as upstream.pgp.asc I can do > [...] > I did a little search and it looks that, in order to automatically > verify upstream tarball, a file like [2] (?) is needed: > is ther

checking upstream signed release

Hello mentors, upstream signed last release [1], and if I download the text and save it as upstream.pgp.asc I can do $ gpg --verify upstream.pgp.asc gpg: Signature made Fri 27 Sep 2024 03:04:43 AM CEST gpg:using RSA key DAC43860630556B6DBF0898FA5DAAEFCB14D13CC gpg: Good signature