Page History

...

There are two steps: generate and verify. You can use a command line interface or a utility. Both methods are described below.

Check using the command line interface

GENERATE. To generate checksums, navigate to the directory containing the .zip file and run the CertUtil command. Append SHA512 and MD5, as shown below, to generate those checksums.  (The default gives you the SHA1 checksum.) 

...

VERIFY. To verify, visually compare the checksums with those listed in the VOTE email, or use an online difference checker.

Check using the MD5 and SHA Checksum Utility

GENERATE. Follow the steps below.

...

You can verify the signatures using a command line interface. See https://httpd.apache.org/dev/verification.html for some general verification info.

Command line interface

1. Download the Taverna key file from https://dist.apache.org/repos/dist/release/incubator/taverna/KEYS. (On Windows this can be done by typing Ctrl-S in the browser window and saving the file as keys.txt.)
   
   
2. Import the key file into GPG:
   

       gpg --import keys.txt

    

3. Download the .asc file. (Save this file in the same folder as keys.txt.)
   
   
4. Verify the .asc file matches the zipped release candidate by using the gpg command with the --verify option followed by the .asc filename and the .zip filename.

...

The idea here is to check that the commit ID in the downloaded file matches that in the VOTE email. You will use a command line interface for at least some of these steps.

Approach 1 (clone the git repository, checkout the commit id, and compare to release candidate)

This approach uses Git commands to compare the downloaded release candidate to a cloned git repository. You will clone one copy and unzip the other copy in such a way that will "trick" Git into thinking you are comparing two versions that you have edited. (I'm missing part of the picture here. What is the end configuration you want before you use git status to compare files?)

...

If there are NO CHANGES, then the commit ID in the VOTE email matches the release candidate.

Approach 2 (download git commit from GitHub and compare to release candidate)

This approach uses the commit id from the VOTE email to download that commit from GitHub, which is then compared to the release candidate using the diff command.

...