From 24320d4fae309cd4f19a8ccff0ab923905d04e8f Mon Sep 17 00:00:00 2001 From: Andrew Gunnerson Date: Sun, 14 Jul 2024 18:23:55 -0400 Subject: [PATCH] README.md: Move signature verification instructions to shared repo Signed-off-by: Andrew Gunnerson --- README.md | 18 +----------------- 1 file changed, 1 insertion(+), 17 deletions(-) diff --git a/README.md b/README.md index 0a6c34c..250e923 100644 --- a/README.md +++ b/README.md @@ -484,23 +484,7 @@ It is possible to run the tests if the host is running Linux, qemu-user-static i ## Verifying digital signatures -First, save the public key to a file listing the keys to be trusted. This is the same key listed in [the author's profile](https://github.com/chenxiaolong/). - -```bash -echo 'avbroot ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDOe6/tBnO7xZhAWXRj3ApUYgn+XZ0wnQiXM8B7tPgv4' > avbroot_trusted_keys -``` - -Then, verify the signature of the zip file using the list of trusted keys. - -```bash -ssh-keygen -Y verify -f avbroot_trusted_keys -I avbroot -n file -s .zip.sig < .zip -``` - -If the file is successfully verified, the output will be: - -``` -Good "file" signature for avbroot with ED25519 key SHA256:Ct0HoRyrFLrnF9W+A/BKEiJmwx7yWkgaW/JvghKrboA -``` +To verify the digital signatures of the downloads, follow [the steps here](https://github.com/chenxiaolong/chenxiaolong/blob/master/VERIFY_SSH_SIGNATURES.md). ## Contributing