nik/liana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

README: mention the verify-commits script

Browse Source
This commit is contained in:
Antoine Poinsot 2023-05-12 13:12:53 +02:00
parent ec55348693
commit 7f6a7ed698
No known key found for this signature in database
GPG Key ID: E13FC145CD3F4304
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
README.md
View File

@ -158,6 +158,25 @@ Releases of Liana are reproducibly built. Linux binaries are also bootstrappable
[`contrib/reproducible`](contrib/reproducible) for details and instructions if you want to check a
release.
All commits on master are merge commits signed using a set of trusted GPG keys. We use the
[`github-merge`](https://github.com/wizardsardine/maintainer-tools) script for this purpose. Given a
set of [trusted
keys](https://github.com/wizardsardine/maintainer-tools/blob/master/verify-commits/liana/trusted-keys)
(basically mine and Edouard Paris') and a [trusted git root
commit](https://github.com/wizardsardine/maintainer-tools/blob/master/verify-commits/liana/trusted-git-root)
you can verify the integrity of the master branch using the
[`verify-commits`](https://github.com/wizardsardine/maintainer-tools/tree/master/verify-commits)
script from our
[`maintainer-tools`](https://github.com/wizardsardine/maintainer-tools) repository. For instance:
```
$ ../maintainer-tools/verify-commits/verify-commits.py liana
...
There is a valid path from "9490159e7ca69678bb6995cd56d09b0a65a5b484" to da9149ccde5bf99cb70769b792fd003b079fc9ed where all commits are signed!
```
It's worth mentioning we didn't invent anything here: we're just reusing the [great
tooling](https://github.com/bitcoin-core/bitcoin-maintainer-tools) developed by the Bitcoin Core
contributors over the years.
Note you necessarily won't be able to reproduce codesigned binaries. We may provide detached
signatures in the future.