1berry/nodejs
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

doc: update signature algorithm in release doc

Browse Source 
Updated doc to reflect what is now done in tools/release.sh

PR-URL: https://github.com/nodejs/node/pull/30673
Reviewed-By: Rod Vagg <rod@vagg.org>
This commit is contained in:
Myles Borins 2019-11-26 15:35:08 -05:00 committed by Daniel Bevenius
parent 84819b8a67
commit c5fc802abc
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
doc/releases.md
View File

@ -577,14 +577,14 @@ however.
computer.
**e.** Sign the `SHASUMS256.txt` file using a command similar to: `gpg
--default-key YOURKEY --clearsign /path/to/SHASUMS256.txt`. You will be prompted
by GPG for your password. The signed file will be named `SHASUMS256.txt.asc`.
--default-key YOURKEY --digest-algo SHA256 --clearsign /path/to/SHASUMS256.txt`.
You will be prompted by GPG for your password. The signed file will be named
SHASUMS256.txt.asc.
**f.** Output an ASCII armored version of your public GPG key using a command
similar to: `gpg --default-key YOURKEY --armor --export --output
/path/to/SHASUMS256.txt.gpg`. This does not require your password and is mainly
a convenience for users, although not the recommended way to get a copy of your
key.
similar to: `gpg --default-key YOURKEY --digest-algo SHA256 --detach-sign /path/to/SHASUMS256.txt`.
You will be prompted by GPG for your password. The signed file will be named
SHASUMS256.txt.sig.
**g.** Upload the `SHASUMS256.txt` files back to the server into the release
directory.
@ -594,8 +594,8 @@ release, you should re-run `tools/release.sh` after the ARM builds have
finished. That will move the ARM artifacts into the correct location. You will
be prompted to re-sign `SHASUMS256.txt`.
It is possible to only sign a release by running `./tools/release.sh -s
vX.Y.Z`.
**It is possible to only sign a release by running `./tools/release.sh -s
vX.Y.Z`.**
### 14. Check the Release