From fff3da1168b91ceec758dbfe6b1e0f8e6ae6fb4b Mon Sep 17 00:00:00 2001 From: rlei Date: Tue, 10 Jul 2018 18:05:01 +0800 Subject: [PATCH 1/2] HAWQ-1638. Add how to verify downloaded files section, removed md5 keys. --- index.html | 50 +++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 43 insertions(+), 7 deletions(-) diff --git a/index.html b/index.html index 4e6f1af..759bf65 100644 --- a/index.html +++ b/index.html @@ -357,8 +357,7 @@

Download HAWQ® 2.2.0.0-incubating

Version 2.2.0.0 | PGP | - SHA-256 | - MD5 + SHA-256
  • @@ -366,8 +365,7 @@

    Download HAWQ® 2.2.0.0-incubating

    Version 2.2.0.0 | PGP | - SHA-256 | - MD5 + SHA-256
    • @@ -396,8 +394,7 @@

    Download HAWQ® 2.1.0.0-incubating

    Version 2.1.0.0 | PGP | - SHA-256 | - MD5 + SHA-256 @@ -427,7 +424,6 @@

    Download HAWQ® 2.0.0.0-incubating

    Version 2.0.0.0 | PGP | SHA-1 | - MD5 @@ -438,6 +434,46 @@

    Download HAWQ® 2.0.0.0-incubating

    +
    +
    +

    How to verify downloaded files?

    +

    + Note: When downloading from a mirror, please be sure to verify that checksums and signatures are correct. To do so, use the checksum and signature files from the main Apache site at + https://www.apache.org/dist/incubator/hawq/. Find here the KEYS file, which contains all OpenPGP keys we use to sign releases here: + KEYS +

    +

    + The PGP signatures can be verified using PGP or GPG. First download the KEYS + as well as the asc signature file for the particular distribution. Then verify the signatures using: +

    +

    + % pgpk -a KEYS +

    + % pgpv ${filename}.tar.gz.asc +

    + or +

    + % pgp -ka KEYS +

    + % pgp ${filename}.tar.gz.asc +

    + or +

    + % gpg --import KEYS +

    + % gpg --verify ${filename}.tar.gz.asc +

    +

    +

    + Alternatively, you can verify the SHA signature on the files.
    + For example, to check a SHA256 sum of a file:
    + On Linux:
    + % sha256sum filename.sha
    + On Mac:
    + % shasum -a 256 filename.sha +

    +
    +
    From 09d9c0fc83b357a39a9f7fe0542a46612473809b Mon Sep 17 00:00:00 2001 From: rlei Date: Wed, 11 Jul 2018 14:44:40 +0800 Subject: [PATCH 2/2] HAWQ-1638. Fix some description words. --- index.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/index.html b/index.html index 759bf65..283dfb6 100644 --- a/index.html +++ b/index.html @@ -439,7 +439,7 @@

    Download HAWQ® 2.0.0.0-incubating

    How to verify downloaded files?

    Note: When downloading from a mirror, please be sure to verify that checksums and signatures are correct. To do so, use the checksum and signature files from the main Apache site at - https://www.apache.org/dist/incubator/hawq/. Find here the KEYS file, which contains all OpenPGP keys we use to sign releases here: + https://www.apache.org/dist/incubator/hawq/. Check here to get all the verification required files including OpenPGP keys that we used to sign releases: KEYS