romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 20:03:52 +03:00
Code Issues Projects Releases Packages Wiki Activity

verify-release: verify more thoroughly with git

Browse source 
If the script is invoked in a git repository it verifies the tarball
better.

Closes #22018
This commit is contained in:
Daniel Stenberg 2026-06-15 12:15:56 +02:00
parent 7333f6674c
commit 6ce740403e
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 59 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

14
docs/VERIFY.md
View file

@ -36,10 +36,24 @@ script that generates a new curl release from source code and then compares
this newly generated release tarball with the tarball file you downloaded from
curl.se.
For full verification, invoke the script inside an up-to-date curl source code
git repository. Without a git repository present, it does a lighter check by
rebuilding the release using the files in the tarball.
Note: full verification mode checks out the release tag in your repository.
Run it in a clean working tree (no local changes) or a dedicated clone.
Invoke it like this:
git clone https://github.com/curl/curl
cd curl
mv [download-dir]/curl-8.19.0.tar.xz .
./scripts/verify-release curl-8.19.0.tar.xz
A successful check ends up with a final output similar to:
curl-8.19.0.tar.xz: OK
By verifying the release tarballs, you verify that Daniel does not infect the
release on purpose or involuntarily because of anything malicious running in
his setup.