Changes between Version 1 and Version 2 of VerifyingSignatures

Timestamp:

Mar 7, 2011 10:07:10 AM (2 years ago)

Author:

marmarek

Comment:

git tag verify

VerifyingSignatures

@@ -91 +91 @@
 within a special 'vault' machine that has no networking, and the private portion
 (hopefully) is never to leave this isolated machine.
+
+== Verifying Qubes code ==
+
+To verify signed git tag, you can use:
+{{{
+$ git tag -v <tag name>
+}}}
+
+You can also set git alias to automatically pull latest tag and verify its signature:
+{{{
+$ git config --global alias.vpull '!f() { tag=`git ls-remote $@ |tail -2 |head -1 |cut -d/ -f 3-`; git pull $@ tag $tag; git tag -v $tag; }; f'
+}}}
+
+then use:
+{{{
+$ git vpull git://git.qubes-os.org/mainstream/core.git
+Already up-to-date.
+object 80826329a71c693fcd08544458b9d6219ca5b28c
+type commit
+tag v1.3.16-dom0
+tagger Joanna Rutkowska <joanna@invisiblethingslab.com> 1290384222 +0100
+
+v1.3.16-dom0
+gpg: Signature made Mon 22 Nov 2010 01:03:50 CET using RSA key ID C37BB66B
+gpg: Good signature from "Joanna Rutkowska (Qubes OS signing key) <joanna@invisiblethingslab.com>"
+}}}
+