1berry/nodejs
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

doc: update signature algorithm in release doc

Browse Source 
Updated doc to reflect what is now done in tools/release.sh

PR-URL: https://github.com/nodejs/node/pull/30673
Reviewed-By: Rod Vagg <rod@vagg.org>
This commit is contained in:
Myles Borins 2019-11-26 15:35:08 -05:00 committed by Daniel Bevenius
parent 84819b8a67
commit c5fc802abc
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
doc/releases.md
View File

@ -577,14 +577,14 @@ however.
computer. computer.
**e.** Sign the `SHASUMS256.txt` file using a command similar to: `gpg **e.** Sign the `SHASUMS256.txt` file using a command similar to: `gpg
--default-key YOURKEY --clearsign /path/to/SHASUMS256.txt`. You will be prompted --default-key YOURKEY --digest-algo SHA256 --clearsign /path/to/SHASUMS256.txt`.
by GPG for your password. The signed file will be named `SHASUMS256.txt.asc`. You will be prompted by GPG for your password. The signed file will be named
SHASUMS256.txt.asc.
**f.** Output an ASCII armored version of your public GPG key using a command **f.** Output an ASCII armored version of your public GPG key using a command
similar to: `gpg --default-key YOURKEY --armor --export --output similar to: `gpg --default-key YOURKEY --digest-algo SHA256 --detach-sign /path/to/SHASUMS256.txt`.
/path/to/SHASUMS256.txt.gpg`. This does not require your password and is mainly You will be prompted by GPG for your password. The signed file will be named
a convenience for users, although not the recommended way to get a copy of your SHASUMS256.txt.sig.
key.
**g.** Upload the `SHASUMS256.txt` files back to the server into the release **g.** Upload the `SHASUMS256.txt` files back to the server into the release
directory. directory.
@ -594,8 +594,8 @@ release, you should re-run `tools/release.sh` after the ARM builds have
finished. That will move the ARM artifacts into the correct location. You will finished. That will move the ARM artifacts into the correct location. You will
be prompted to re-sign `SHASUMS256.txt`. be prompted to re-sign `SHASUMS256.txt`.
It is possible to only sign a release by running `./tools/release.sh -s **It is possible to only sign a release by running `./tools/release.sh -s
vX.Y.Z`. vX.Y.Z`.**
### 14. Check the Release ### 14. Check the Release