From: James Almer <jamrial@gmail.com>
To: ffmpeg-devel@ffmpeg.org
Subject: Re: [FFmpeg-devel] [PATCH] web/download: Extend the verification procedure to check for difference between git and release tarball
Date: Sat, 30 Mar 2024 11:51:17 -0300
Message-ID: <ef8a2c6f-1790-4eb9-a3ea-5334f2acf3d2@gmail.com> (raw)
In-Reply-To: <20240330140225.3395-1-michael@niedermayer.cc>
On 3/30/2024 11:02 AM, Michael Niedermayer wrote:
> Iam not 100% sure this is the best place to put this. But we should somewhere
> describe what differences are expected
>
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
> src/download | 34 ++++++++++++++++++++++++++++++++++
> 1 file changed, 34 insertions(+)
>
> diff --git a/src/download b/src/download
> index 0e6fa7e..34733de 100644
> --- a/src/download
> +++ b/src/download
> @@ -284,6 +284,40 @@ gpg: using RSA key FCF986EA15E6E293A5644F10B4322F04D67658D8
> gpg: issuer "ffmpeg-devel@ffmpeg.org"
> gpg: Good signature from "FFmpeg release signing key <ffmpeg-devel@ffmpeg.org>" [full]</pre>
> </li>
> + <li>
> + Verify that the release tarball matches the git tag: (expected differences are missing .git, .gitignore and .gitattributes and an additional VERSION file)
> + <pre>
> + $ diff -ru ffmpeg-5.1.4 gitdir2
> +Only in gitdir2/doc/doxy: .gitignore
> +Only in gitdir2/doc/examples: .gitignore
> +Only in gitdir2/doc: .gitignore
> +Only in gitdir2/ffbuild: .gitignore
> +Only in gitdir2: .git
> +Only in gitdir2: .gitattributes
> +Only in gitdir2: .gitignore
> +Only in gitdir2/libavcodec: .gitignore
> +Only in gitdir2/libavcodec/tests: .gitignore
> +Only in gitdir2/libavdevice: .gitignore
> +Only in gitdir2/libavdevice/tests: .gitignore
> +Only in gitdir2/libavfilter: .gitignore
> +Only in gitdir2/libavfilter/opencl: .gitignore
> +Only in gitdir2/libavfilter/tests: .gitignore
> +Only in gitdir2/libavformat: .gitignore
> +Only in gitdir2/libavformat/tests: .gitignore
> +Only in gitdir2/libavutil: .gitignore
> +Only in gitdir2/libavutil/tests: .gitignore
> +Only in gitdir2/libswresample/tests: .gitignore
> +Only in gitdir2/libswscale/tests: .gitignore
> +Only in gitdir2/tests/api: .gitignore
> +Only in gitdir2/tests/checkasm: .gitignore
> +Only in gitdir2/tests: .gitignore
> +Only in gitdir2/tools: .gitignore
> +Only in ffmpeg-5.1.4: VERSION
> + </pre>
> + </li>
> + <li>
> + Verify that the tag in git is signed
The tags are signed with your key made for this purpose,
DD1EC9E8DE085C629B3E1846B18E8928B3948D64, and not with the tarball one
listed above. You should include it here the same way, unless the
signature check for tags is documented elsewhere? If so, a link to that
place.
> + </li>
> </ol>
> </p>
>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
next prev parent reply other threads:[~2024-03-30 14:51 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-30 14:02 Michael Niedermayer
2024-03-30 14:51 ` James Almer [this message]
2024-03-30 17:30 ` Michael Niedermayer
2024-03-30 17:31 ` James Almer
2024-03-30 21:19 ` Michael Niedermayer
2024-03-30 20:30 ` Kieran Kunhya
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ef8a2c6f-1790-4eb9-a3ea-5334f2acf3d2@gmail.com \
--to=jamrial@gmail.com \
--cc=ffmpeg-devel@ffmpeg.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
This inbox may be cloned and mirrored by anyone:
git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
ffmpegdev@gitmailbox.com
public-inbox-index ffmpegdev
Example config snippet for mirrors.
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git