Next: Build instructions, Previous: Prepared tarballs, Up: Installation [Index]
You have to check downloaded archives integrity and verify their signature to be sure that you have got trusted, untampered software. For integrity and authentication of downloaded binaries GNU Privacy Guard is used. You must download signature (.sig) provided with the tarball.
For the very first time you need to import signing public key. It is provided below, but it is better to check alternative resources with it.
pub rsa2048/0x2B25868E75A1A953 2017-01-10 92C2 F0AE FE73 208E 46BF F3DE 2B25 868E 75A1 A953 uid NNCP releases <releases at nncpgo dot org>
$ gpg --auto-key-locate dane --locate-keys releases at nncpgo dot org $ gpg --auto-key-locate wkd --locate-keys releases at nncpgo dot org
-----BEGIN PGP PUBLIC KEY BLOCK----- mQENBFh0lv0BCADmquHdyjr1Mr8VHRNxzipHxmgbdK3CGJL1yzb1ntj7zbJl5UnQ 71cxQ968pYPOBYqsA3oqtURAXzVL6qPGajHM+OXKB5OOjmt7vbd3xP5sBCWOjlrq S7yWx5ffuXf++tCGiXGkG7q+4zmXJUBuaot0fQ5ebBVLzVVIMv2C4hArZFZtK+YZ GkrIU+S49joe4qeUdCIQ1KpEB2m774QFxG05fMMys9L60wkL6ZgAy0GadkvCI5jD Xj5nRxa0fn+T/pcOWCpy7ka4rCR0rKCCNB8ARvpDnknTu2S9cxnWy1uOMv8JQpTb nY27vprdkH9aykdPl/7uHL/X1hutFxE8FOAjABEBAAG0I05OQ1AgcmVsZWFzZXMg PHJlbGVhc2VzQG5uY3Bnby5vcmc+iQFXBBMBCABBFiEEksLwrv5zII5Gv/PeKyWG jnWhqVMFAlh0lv0CGwMMCwoJDQgMBwsDBAECBxUKCQgLAwIFFgIBAwACHgECF4AA CgkQKyWGjnWhqVOaBggAqWywYtUddljHpiR/SK8uiYjSl8/F4QemM+tsu66GW56Y ZB7VFOxNFcpEfSnWwH61cJ5lCuRRgyjJcIOptzbKbO+nvYQEtXznjQYoJMLnPqAa 2UPI5Seaijx8sXQWzYRq2Vzl9KUDBlhB2y4jZD4CFC1V29NRbWuPUajZn8UiZzFT IUR/gjvtYQozF0jN8Sevs+oGAN1tqK5kYo8YXEeL+3NCVUJkqFmBtFVxrxzty4cE ozgKpXzt9bi10a1hthKluWcZD6Zc4InqQhAGXb2JB2a5wRTs8CkJtHadwBOD3JEt HjfhBAoZMYmhOBeHt87AG5OjFNRIOJ2rRacnRDA3E4h1BBARCAAdFiEEz2Domlkj HnbiY2QirhqBCeSYV+8FAlh0lxYACgkQrhqBCeSYV+9i1QD/bdLAY67nf5giI/wQ i6K7v6PTPFwG6TtG6jj68Cy13RgA/iMuKw7niLwyPWRKzWcMIG1YhVyCNCgKQvFL vdr6yKbNiHUEEBYKAB0WIQQSrTJonGYNQmln/XXLggVjIQetigUCYuo7ggAKCRDL ggVjIQetipd7AQCDFrOVsnUUz0erg3Xja0AwEbaFvlCszMqw4WrER7N76wEAkPhR LTpxZzCiX0XH91+xCQVU+m5idln1affz7Dntnw4= =7iHk -----END PGP PUBLIC KEY BLOCK-----
Then you could verify tarballs signature:
$ gpg --verify nncp-8.8.2.tar.xz.sig nncp-8.8.2.tar.xz