diff options
author | Jameson Lopp <jameson.lopp@gmail.com> | 2018-11-26 10:22:36 -0500 |
---|---|---|
committer | Jameson Lopp <jameson.lopp@gmail.com> | 2018-12-06 10:41:08 -0500 |
commit | 45842c3d26098ad6d12f5cb96bbcf9bcde650950 (patch) | |
tree | 9803b0606d8c879f5b20a6a79b2a0c714feb4f07 /contrib/verify-commits/README.md | |
parent | 327129f7a6440e3bbd0a0ea415ea5f8907cf3233 (diff) | |
download | bitcoin-45842c3d26098ad6d12f5cb96bbcf9bcde650950.tar.xz |
Improve documentation for running verify-commits.py script
Diffstat (limited to 'contrib/verify-commits/README.md')
-rw-r--r-- | contrib/verify-commits/README.md | 17 |
1 files changed, 13 insertions, 4 deletions
diff --git a/contrib/verify-commits/README.md b/contrib/verify-commits/README.md index aa805ad1b9..27ca15acb4 100644 --- a/contrib/verify-commits/README.md +++ b/contrib/verify-commits/README.md @@ -3,7 +3,7 @@ Tooling for verification of PGP signed commits This is an incomplete work in progress, but currently includes a pre-push hook script (`pre-push-hook.sh`) for maintainers to ensure that their own commits -are PGP signed (nearly always merge commits), as well as a script to verify +are PGP signed (nearly always merge commits), as well as a Python 3 script to verify commits against a trusted keys list. @@ -17,9 +17,11 @@ be backdoored. Instead, you need to use a trusted version of verify-commits prior to checkout to make sure you're checking out only code signed by trusted keys: - git fetch origin && \ - ./contrib/verify-commits/verify-commits.py origin/master && \ - git checkout origin/master + ```sh + git fetch origin && \ + ./contrib/verify-commits/verify-commits.py origin/master && \ + git checkout origin/master + ``` Note that the above isn't a good UI/UX yet, and needs significant improvements to make it more convenient and reduce the chance of errors; pull-reqs @@ -33,6 +35,13 @@ Configuration files * `trusted-keys`: This file should contain a \n-delimited list of all PGP fingerprints of authorized commit signers (primary, not subkeys). * `allow-revsig-commits`: This file should contain a \n-delimited list of git commit hashes. See next section for more info. +Import trusted keys +------------------- +In order to check the commit signatures you must add the trusted PGP keys to your machine. This can be done in Linux by running +```sh +gpg --recv-keys $(<contrib/verify-commits/trusted-keys) +``` + Key expiry/revocation --------------------- |