Skip to content

Commit

Permalink
fix: update the validation documentation for gpg keys
Browse files Browse the repository at this point in the history
Signed-off-by: Terry Howe <[email protected]>
  • Loading branch information
TerryHowe committed Jan 8, 2025
1 parent 4e73bda commit 8a16338
Show file tree
Hide file tree
Showing 3 changed files with 21 additions and 12 deletions.
11 changes: 7 additions & 4 deletions versioned_docs/version-1.1/how_to_guides/verifying_binaries.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -12,23 +12,26 @@ The following commands can be used to verify the ORAS CLI binaries using GPG:

### Step 1:

First, we import the releaser's GPG Key which can be used for verification (here we have imported [Billy Zha](https://github.com/qweeah)'s key):
First, we import the releasers' GPG Keys which can be used for verification:

```
$ curl -sSL https://github.com/qweeah.gpg | gpg --import -
$ curl -sSL https://raw.githubusercontent.com/oras-project/oras/refs/heads/main/KEYS | gpg --import -
```

You can find the [GPG keys](https://github.com/oras-project/oras/blob/main/KEYS) which have been used for ORAS releases.
The [GPG keys file](https://github.com/oras-project/oras/blob/main/KEYS) contains the keys which have been used for ORAS releases.

### Step 2:

You can run the following command to check if the key has been imported:
You can run the following command to check if the key has been imported. Your output will look something like:

```
$ gpg --list-keys
pub rsa4096 2023-02-28 [SC] [expires: 2024-02-28]
BE6FA8DDA48D4C230091A0A9276D8A724CE1C704
uid [ unknown] Billy Zha <[email protected]>
pub rsa4096 2024-12-04 [SC] [expires: 2025-12-04]
73C7F42E8F0B4493115ABED64F723223E9DF0185
uid [ unknown] Shiwei Zhang <[email protected]>
```

### Step 3:
Expand Down
11 changes: 7 additions & 4 deletions versioned_docs/version-1.2/how_to_guides/verifying_binaries.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -12,23 +12,26 @@ The following commands can be used to verify the ORAS CLI binaries using GPG:

### Step 1:

First, we import the releaser's GPG Key which can be used for verification (here we have imported [Billy Zha](https://github.com/qweeah)'s key):
First, we import the releasers' GPG Keys which can be used for verification:

```
$ curl -sSL https://github.com/qweeah.gpg | gpg --import -
$ curl -sSL https://raw.githubusercontent.com/oras-project/oras/refs/heads/main/KEYS | gpg --import -
```

You can find the [GPG keys](https://github.com/oras-project/oras/blob/main/KEYS) which have been used for ORAS releases.
The [GPG keys file](https://github.com/oras-project/oras/blob/main/KEYS) contains the keys which have been used for ORAS releases.

### Step 2:

You can run the following command to check if the key has been imported:
You can run the following command to check if the key has been imported. Your output will look something like:

```
$ gpg --list-keys
pub rsa4096 2023-02-28 [SC] [expires: 2024-02-28]
BE6FA8DDA48D4C230091A0A9276D8A724CE1C704
uid [ unknown] Billy Zha <[email protected]>
pub rsa4096 2024-12-04 [SC] [expires: 2025-12-04]
73C7F42E8F0B4493115ABED64F723223E9DF0185
uid [ unknown] Shiwei Zhang <[email protected]>
```

### Step 3:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,23 +12,26 @@ The following commands can be used to verify the ORAS CLI binaries using GPG:

### Step 1:

First, we import the releaser's GPG Key which can be used for verification (here we have imported [Billy Zha](https://github.com/qweeah)'s key):
First, we import the releasers' GPG Keys which can be used for verification:

```
$ curl -sSL https://github.com/qweeah.gpg | gpg --import -
$ curl -sSL https://raw.githubusercontent.com/oras-project/oras/refs/heads/main/KEYS | gpg --import -
```

You can find the [GPG keys](https://github.com/oras-project/oras/blob/main/KEYS) which have been used for ORAS releases.
The [GPG keys file](https://github.com/oras-project/oras/blob/main/KEYS) contains the keys which have been used for ORAS releases.

### Step 2:

You can run the following command to check if the key has been imported:
You can run the following command to check if the key has been imported. Your output will look something like:

```
$ gpg --list-keys
pub rsa4096 2023-02-28 [SC] [expires: 2024-02-28]
BE6FA8DDA48D4C230091A0A9276D8A724CE1C704
uid [ unknown] Billy Zha <[email protected]>
pub rsa4096 2024-12-04 [SC] [expires: 2025-12-04]
73C7F42E8F0B4493115ABED64F723223E9DF0185
uid [ unknown] Shiwei Zhang <[email protected]>
```

### Step 3:
Expand Down

0 comments on commit 8a16338

Please sign in to comment.