You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 

5.9 KiB

layout title permalink
page Software /software/

Table of contents

Introduction

This page is the only real trusted source of some of my software.

Here you will find methods to assert the authenticity of the presented software packages.

You may contact me directly to obtain the public key fingerprint in a different way.

Extract

The following extract is from a post by Mike Gerwitz:

Git Host

Git hosting providers are probably the most easily overlooked trustees—providers like Gitorious, GitHub, Bitbucket, SourceForge, Google Code, etc. Each provides hosting for your repository and “secures” it by allowing only you, or other authorized users, to push to it, often with the use of SSH keys tied to an account. By using a host as the primary holder of your repository—the repository from which most clone and push to—you are entrusting them with the entirety of your project; you are stating, “Yes, I trust that my source code is safe with you and will not be tampered with”. This is a dangerous assumption. Do you trust that your host properly secures your account information? Furthermore, bugs exist in all but the most trivial pieces of software, so what is to say that there is not a vulnerability just waiting to be exploited in your host’s system, completely compromising your repository?

It was not too long ago (March 4th, 2012) that a public key security vulnerability at GitHub was exploited by a Russian man named Egor Homakov, allowing him to successfully commit to the master branch of the Ruby on Rails framework repository hosted on GitHub. Oops.

Copyright © 2019 Mike Gerwitz. Licensed under the Creative Commons Attribution-ShareAlike 4.0 International License. 

Terminology

  • project_dir: the full path directory of the project
  • project: the project name
  • tag: the git tag name which is usually semvered
  • signing_key: the public key file used to sign the archive file
  • url: a generic url

Methods

Upload

What follows are the steps I use to upload the software on this page.

Create an archive

cd /tmp
git -C ${project_dir} archive --format=tar.gz --output=/tmp/${project}-${tag}.tar.gz --prefix=${project}-${tag}/ ${tag}

Signing

gpg --armor --output ${project}-${tag}.tar.gz.sig --detach-sig ${project}-${tag}.tar.gz

Checksums

sha512sum ${project}-${tag}.tar.gz > ${project}-${tag}.tar.gz.SHA512SUM.txt
sha256sum ${project}-${tag}.tar.gz > ${project}-${tag}.tar.gz.SHA256SUM.txt

Update the entry

- `${tag}`
  - [${project}-${tag}.tar.gz]({{ site.baseurl }}/software/${project}-${tag}.tar.gz)
  - [SHA512SUM.txt]({{ site.baseurl }}/software/${project}-${tag}.tar.gz.SHA512SUM.txt)
  - [SHA256SUM.txt]({{ site.baseurl }}/software/${project}-${tag}.tar.gz.SHA256SUM.txt)
  - [signature]({{ site.baseurl }}/software/${project}-${tag}.tar.gz.sig)
  - [signing key]({{ site.baseurl }}/pubkeys/${signing_key})

Update the table of contents

md_toc -p github -l 6 software.md

Download

Run the following to download and verify the software.

Get the public key

If the public key is unknown you must import it from a trusted source:

cd /tmp
wget "${public_key_url}"
gpg --import "${public_key_file}"

Download the repository

cd /tmp
wget ${url}/${project}-${tag}.tar.gz.sig

Check the signature

wget ${url}/${project}-${tag}.tar.gz
gpg --verify ${project}-${tag}.tar.gz.sig

Run the checksums

sha512sum --check ${project}-${tag}.tar.gz.SHA512SUM.txt
sha256sum --check ${project}-${tag}.tar.gz.SHA256SUM.txt

Extract

tar -xvzf ${project}-${tag}.tar.gz

Keys

Key Fingerprint
[pgp_pubkey_2020.txt]({{ site.baseurl }}/pubkeys/pgp_pubkey_2020.txt) [pgp_pubkey_fingerprint_2020.txt]({{ site.baseurl }}/pubkeys/pgp_pubkey_fingerprint_2020.txt)

Software

fpyutils

Repository

Releases

  • 1.2.0
    • [fpyutils-1.2.0.tar.gz]({{ site.baseurl }}/software/fpyutils-1.2.0.tar.gz)
    • [SHA512SUM.txt]({{ site.baseurl }}/software/fpyutils-1.2.0.tar.gz.SHA512SUM.txt)
    • [SHA256SUM.txt]({{ site.baseurl }}/software/fpyutils-1.2.0.tar.gz.SHA256SUM.txt)
    • [signature]({{ site.baseurl }}/software/fpyutils-1.2.0.tar.gz.sig)
    • [signing key]({{ site.baseurl }}/pubkeys/pgp_pubkey_2020.txt)

md-toc

Repository

Releases

  • 7.0.3
    • [md-toc-7.0.3.tar.gz]({{ site.baseurl }}/software/md-toc-7.0.3.tar.gz)
    • [SHA512SUM.txt]({{ site.baseurl }}/software/md-toc-7.0.3.tar.gz.SHA512SUM.txt)
    • [SHA256SUM.txt]({{ site.baseurl }}/software/md-toc-7.0.3.tar.gz.SHA256SUM.txt)
    • [signature]({{ site.baseurl }}/software/md-toc-7.0.3.tar.gz.sig)
    • [signing key]({{ site.baseurl }}/pubkeys/pgp_pubkey_2020.txt)