diff --git a/verify.md b/verify.md index 6a0eaf3..3e00189 100644 --- a/verify.md +++ b/verify.md @@ -10,7 +10,7 @@ The Minisign signatures for each PDF and ODT files are available here: - PDF (Light Theme) Main and Mirrors: [guide.pdf.minisig](guide.pdf.minisig) (Currently unavailable) - ODT Main and Mirrors: [guide.odt.minisig](guide.odt.minisig) (Currently unavailable) -### How to check the integrity of the files using the SHA256 checksums: +### How to check the integrity of files using SHA256 checksums: First get the hash of your local file by following these steps for your OS: @@ -18,7 +18,7 @@ Windows: - From a command prompt, run ```certutil -hashfile filename.txt sha256``` - Compare the obtained hash result of your local file to the online file's published hash. They should match. -MacOS: +macOS: - From a terminal, run ```shasum -a 256 /full/path/to/your/file``` - Compare the obtained hash result of your local file to the online file's published hash. They should match. @@ -26,16 +26,14 @@ Linux: - From a terminal, run ```sha256sum /full/path/to/your/file``` - Compare the obtained hash result of your local file to the online file's published hash. They should match. -All commits and releases on this repository are cryptographically signed and verified using the same GPG key. +All commits and releases on this repository are cryptographically signed and verified by each collaborator (check for the "Verified" tags on commits and releases). -**Do check for the "Verified" tags on each commit or release.** +### How to verify the the authenticity and integrity of files using GPG: -### How to verify the the authenticity and integrity of the files using GPG: - -To verify the files with GPG signatures, you should first install gpg on your system: +To verify files with GPG signatures, you should first install gpg on your system: - Windows: Install gpg4win from - MacOS: Install GPG Tools from -- Linux: gpg should be installed by default +- Linux: gpg should be installed by default. If not, use your Linux package manager to install it such as apt (debian) or rpm (red hat). Import the GPG key from a trusted source of the publisher using the following command from a command prompt or terminal: @@ -52,7 +50,7 @@ You should then import it manually by issuing the following command on any OS: ```gpg --import 42FF35DB9DE7C088AB0FD4A70C216A52F6DF4920.asc``` -Finally, verify the asc signature file (links above) against the PDF files by issuing the following commands: +Finally, verify the asc signature file (links above) against the PDF file by issuing the following example command: ```gpg --verify guide.pdf.asc guide.pdf"``` @@ -62,14 +60,14 @@ This should output a result showing it matches and is therefore a good result. To verify the files with Minisign: -- You should first download minisign from . +- First, download minisign from . - Download the files along with their \*.minisig signature file (these should be in the same directory). - Download the Minisign public key available on the website and repository: [minisign.pub](minisign.pub) (again, place it in the same directory for convenience). -- Run the following command in a command prompt or terminal: ```minisign -Vm guide.pdf -p minisign.pub```. +- Run the following command in a command prompt or terminal within the directory with both files: ```minisign -Vm guide.pdf -p minisign.pub```. - Output should show ```Signature and comment signature verified```. -### How to check the safety of the files using VT: -**Note: we not endorse VT. It should be used with extreme caution and never with any sensitive files due to their privacy policies.** +### How to check the relative safety of files or even URLs (such as https://anonymousplanet.org) using VirusTotal: +**Note: we not endorse VirusTotal. It should be used with extreme caution and never with any sensitive files due to their privacy policies. Do not upload sensitive files to VirusTotal** Temporarily Disabled. The PDF and ODT files of this guide have been checked by VT, see the links below for an example but do not trust these hashes blindly. Check the hashes match and re-upload to VT if needed: - PDF file: [[VT Scan]](https://www.virustotal.com/gui/file/21dfa2f7da668156275e4ca2bc82091f347739967a278cf24a062c15a3944016?nocache=1) @@ -81,7 +79,7 @@ For additional safety, you can always double check the PDF files using the PDFID Here are the steps: -- Install latest 3.9.x version of Python on your OS, Download PDFID and, from a command prompt or terminal, run: +- Install latest 3.9.x / 3.10.x version of Python on your OS, Download PDFID and, from a command prompt or terminal, run: ```python pdfid.py file-to-check.pdf```