diff --git a/docs/gpg-setup.rst b/docs/gpg-setup.rst new file mode 100644 index 000000000..cb8cbfd20 --- /dev/null +++ b/docs/gpg-setup.rst @@ -0,0 +1,18 @@ +Preparing to Authenticate Release (Setting up GPG) +-------------------------------------------------- + +In other to keep releases authentic it's required that releases are signed before being +published. This ensure's that users of Tahoe are able to verify that the version of Tahoe +they are using is coming from a trusted or at the very least known source. + +The authentication is done using the ``GPG`` implementation of ``OpenGPG`` to be able to complete +the release steps you would have to download the ``GPG`` software and setup a key(identity). + +- `Download `__ and install GPG for your operating system. +- Generate a key pair using ``gpg --gen-key``. *Some questions would be asked to personalize your key configuration.* + +You might take additional steps including: + +- Setting up a revocation certificate (Incase you lose your secret key) +- Backing up your key pair +- Upload your fingerprint to a keyserver such as `openpgp.org `__ diff --git a/docs/release-checklist.rst b/docs/release-checklist.rst index 0ba94df3a..3b313da61 100644 --- a/docs/release-checklist.rst +++ b/docs/release-checklist.rst @@ -34,6 +34,7 @@ Tuesday if you want to get anything in"). - Create a ticket for the release in Trac - Ticket number needed in next section +- Making first release? See `GPG Setup Instructions `__ to make sure you can sign releases. [One time setup] Get a clean checkout ```````````````````` @@ -96,27 +97,6 @@ Create Branch and Apply Updates - Confirm CI runs successfully on all platforms -Preparing to Authenticate Release (Setting up GPG) -`````````````````````````````````````````````````` -*Skip the section if you already have GPG setup.* - -In other to keep releases authentic it's required that releases are signed before being -published. This ensure's that users of Tahoe are able to verify that the version of Tahoe -they are using is coming from a trusted or at the very least known source. - -The authentication is done using the ``GPG`` implementation of ``OpenGPG`` to be able to complete -the release steps you would have to download the ``GPG`` software and setup a key(identity). - -- `Download `__ and install GPG for your operating system. -- Generate a key pair using ``gpg --gen-key``. *Some questions would be asked to personalize your key configuration.* - -You might take additional steps including: - -- Setting up a revocation certificate (Incase you lose your secret key) -- Backing up your key pair -- Upload your fingerprint to a keyserver such as `openpgp.org `__ - - Create Release Candidate ````````````````````````