From 89b267ff56cc4c0e35afadbc09fdfabeafed9a9c Mon Sep 17 00:00:00 2001 From: Hinrich Mahler <22366557+Bibo-Joshi@users.noreply.github.com> Date: Wed, 10 Jul 2024 12:48:00 +0200 Subject: [PATCH 1/3] Update information on verifying releases --- verify-releases.html | 58 +++++++++++++++++++++++++++----------------- 1 file changed, 36 insertions(+), 22 deletions(-) diff --git a/verify-releases.html b/verify-releases.html index f5e1ca8..eb6163a 100644 --- a/verify-releases.html +++ b/verify-releases.html @@ -89,28 +89,42 @@

We have made you a wrapper you can't refuse


Verifying releases

-

- We sign all the releases with a GPG key. - The signatures are uploaded to both the GitHub - releases page and the PyPI - project and end with a suffix .asc. - Please find the public keys below. - The keys are named in the format - <first_version>-<last_version>.gpg or <first_version>-current.gpg - if the key is currently being used for new releases. -

-
-

- In addition, the GitHub release page also contains the sha1 hashes of the release files - in the files with the suffix .sha1. -

-
-

- This allows you to verify that a release file that you downloaded was indeed provided by - the python-telegram-bot team. -

-
+

+ To enable you to verify that a release file that you downloaded was indeed provided by + the python-telegram-bot team, we have taken the following measures. +

+
+

+ Starting with NEXT.VERSION, all releases are signed via sigstore. + The corresponding signature files are uploaded to the GitHub + releases page. + To verify the signature, please install the sigstore Python client and follow the + instructions for verifying + signatures from GitHub Actions. As input for the --repository + parameter, please use the value python-telegram-bot/python-telegram-bot. +

+
+

+ Earlier releases are signed with a GPG key. + The signatures are uploaded to both the GitHub + releases page + and the PyPI project and end + with a suffix .asc. + Please find the public keys below or here. + The keys are named in the format + <first_version>-<last_version>.gpg. +

+
+

+ In addition, the GitHub release page also contains the sha1 hashes of the release files + in the files with the suffix .sha1. +

+

Public keys

From a467d2024f3ef449a490e857b876f1445b6c96cb Mon Sep 17 00:00:00 2001 From: Hinrich Mahler <22366557+Bibo-Joshi@users.noreply.github.com> Date: Fri, 12 Jul 2024 16:40:10 +0200 Subject: [PATCH 2/3] update gpg key naming --- verify-releases.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/verify-releases.html b/verify-releases.html index eb6163a..734b083 100644 --- a/verify-releases.html +++ b/verify-releases.html @@ -130,7 +130,7 @@

Public keys

-
v20.0-current.gpg
 +
v20.0-v21.3.gpg
 
 -----BEGIN PGP PUBLIC KEY BLOCK-----
 

From 5adcd4cfb9fd05840fd1379cb995ee0634130e74 Mon Sep 17 00:00:00 2001
From: Hinrich Mahler <22366557+Bibo-Joshi@users.noreply.github.com>
Date: Fri, 12 Jul 2024 17:18:01 +0200
Subject: [PATCH 3/3] insert correct version

---
 verify-releases.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/verify-releases.html b/verify-releases.html
index 734b083..da9ed08 100644
--- a/verify-releases.html
+++ b/verify-releases.html
@@ -95,7 +95,7 @@ 
Verifying releases

         

         

         

-            Starting with NEXT.VERSION, all releases are signed via sigstore.
+            Starting with v21.4, all releases are signed via sigstore.
             The corresponding signature files are uploaded to the GitHub
             releases page.