On unix platforms and mac's download all source and binary artifacts into a new directory and cd to the download directory.
for file in `find . -type f -iname '*.asc'`
do
gpg --verify ${file}
done
The output will indicate the You'll need to look at the output to ensure it contains only good signatures -
gpg: Good signature from ... gpg: Signature made ...
...
Progress Bar Container |
---|
|
Progress Bar - Hyperlink Step |
---|
title | Overview |
---|
url | Apache Airavata Release Management |
---|
|
Progress Bar - Hyperlink Step |
---|
title | Release Setup |
---|
url | One-Time Release Setup |
---|
|
Progress Bar - Hyperlink Step |
---|
title | Pre-Release Steps |
---|
url | Pre-Release Check List |
---|
|
Progress Bar - Hyperlink Step |
---|
title | Release Preparation |
---|
url | Release Prepration |
---|
|
Progress Bar - Hyperlink Step |
---|
title | Make the Release |
---|
url | Make the Release |
---|
|
Progress Bar - Hyperlink Step |
---|
title | Fallback -- if needed |
---|
url | Recovering from a vetoed release |
---|
|
Progress Bar - Hyperlink Step |
---|
title | Verify Release |
---|
url | Verifying Release Signatures |
---|
|
Progress Bar - Hyperlink Step |
---|
title | Post Release Steps |
---|
url | Post Release Finishes |
---|
|
|
...