commit bf53fbece8eef94537162077a840dfeed0d1bc9e
parent 6499f18c9ef9cd75d263eb17e40d871a5a4cdcd8
Author: Vincent Forest <vincent.forest@meso-star.com>
Date: Sun, 12 Jul 2026 12:16:20 +0200
Replace PGP signature with SHA512 checksum
If using a checksum instead of an encrypted signature seems less secure,
there was actually no simple way to retrieve the PGP key used to sign
the archives. So that checking their integrity was never done. Yet this
was the first object of the signatures, before validating the identity
of their distributor.
In addition, PGP makes workflow more complex. For example, there was no
PGP key shared between the different contributors, each using its own
key to sign the archives. As a result, every update of published content
could change the signatures of all archives.
From now on, the archive is accompanied by a simple SHA512 checksum
which alone, allows to verify the integrity of the associated data. And
every contributor generates by construction the same checksum. If the
content is no longer signed, check its integrity is now made simple. Not
only do the authors/users no longer need a GPG key to sign/verify an
archive, but the published content is now the same independently of the
contributor published it.
Diffstat:
15 files changed, 55 insertions(+), 33 deletions(-)
diff --git a/.gitignore b/.gitignore
@@ -2,6 +2,7 @@
*.sw[po]
*.[ao]
*.sig
+*.sha512
*.err
*~
.chk
diff --git a/art/hooks/00-sign-archives.sh b/art/hooks/00-sign-archives.sh
@@ -17,19 +17,24 @@
set -e
-find downloads -name "*.tgz" \
+cd downloads
+
+find . -name "*.tgz" \
| sort \
| while read -r i; do
- sign="${i}.sig"
+file="$(basename "${i}")" # Rm the "./" prefix
+
+ algo="sha512"
+ sign="${file}.${algo}"
if ! [ -f "${sign}" ]; then
- >&2 printf 'Signing %s\n' "${i}"
- gpg --yes -a -o "${sign}" --detach-sign "${i}"
+ >&2 printf 'Signing %s\n' "${file}"
+ cksum -a "${algo}" "${file}" > "${sign}"
fi
# Write the generated files to standard output to inform the build
# system which files it needs to handle during installation.
- printf '%s/%s\n' "${PWD##*/}" "${i}.sig"
+ printf '%s/%s\n' "${PWD##*/}" "${sign}"
done
diff --git a/art/hr_ppart.md b/art/hr_ppart.md
@@ -29,7 +29,7 @@ Reference results are only achieved for a purely absorbing atmosphere.
## Quick start
- Sources: [tarball](downloads/hr_ppart.tgz) /
- [pgp](downloads/hr_ppart.tgz.sig)
+ [sha512](downloads/hr_ppart.tgz.sha512)
### Prerequisites
diff --git a/art/karine.md.in b/art/karine.md.in
@@ -64,7 +64,7 @@ immediately identified, for any given spectral interval.
Karine @VERSION@:
- Sources: [tarball](downloads/karine@VERSION@.tgz) /
- [pgp](downloads/karine@VERSION@.tgz.sig)
+ [sha512](downloads/karine@VERSION@.tgz.sha512)
- Manual: [pdf](downloads/karine@VERSION@_manual.pdf)
### Prerequisites
diff --git a/art/kdistribution.md.in b/art/kdistribution.md.in
@@ -34,7 +34,7 @@ necessarily have to be identical to the file used by Kspectrum.
## Quickstart
- Sources: [tarball](downloads/kdistribution_light@VERSION@.tgz) /
- [pgp](downloads/kdistribution_light@VERSION@.tgz.sig)
+ [sha512](downloads/kdistribution_light@VERSION@.tgz.sha512)
- Installation script: [bash](downloads/install_kdistribution_light@VERSION@.bash)
- Manual: [pdf](downloads/kdistribution_light@VERSION@_manual.pdf)
diff --git a/art/kspectrum.md.in b/art/kspectrum.md.in
@@ -110,7 +110,7 @@ Also, the code has been implemented with the obsessions of:
Kspectrum @VERSION@:
- Sources: [tarball](downloads/kspectrum@VERSION@.tgz) /
- [pgp](downloads/kspectrum@VERSION@.tgz.sig)
+ [sha512](downloads/kspectrum@VERSION@.tgz.sha512)
- Installation script: [bash](downloads/install_kspectrum@VERSION@.bash)
- Manual: [pdf](downloads/kspectrum@VERSION@_manual.pdf)
diff --git a/art/ppart_lw.md b/art/ppart_lw.md
@@ -17,7 +17,7 @@ atmosphere, for clear-sky LW computations only.
## Quick start
- Sources: [tarball](downloads/ppart_lw.tgz) /
- [pgp](downloads/ppart_lw.tgz.sig)
+ [sha512](downloads/ppart_lw.tgz.sha512)
### Prerequisites
diff --git a/art/ppart_sw.md b/art/ppart_sw.md
@@ -21,7 +21,7 @@ when the atmosphere is hot enough).
## Quick start
- Sources: [tarball](downloads/ppart_sw.tgz) /
- [pgp](downloads/ppart_sw.tgz.sig)
+ [sha512](downloads/ppart_sw.tgz.sha512)
### Prerequisites
diff --git a/htrdr/config.sh.in b/htrdr/config.sh.in
@@ -32,12 +32,12 @@ list_starter_packs()
printf '<table class="list">\n'
printf ' <tr><th>Version</th><th>Archive</th></tr>\n'
while read -r _i ; do
- _version="$(echo "${_i}" | sed "s/.*Starter-Pack-\(.*\)\.tar.gz/\1/g")"
+ _version="$(echo "${_i}" | sed "s/.*Starter-Pack-\(.*\)\.tar.gz/\1/g")"
printf ' <tr>\n'
printf ' <td>%s</td>\n' "${_version}"
printf ' <td>\n'
printf ' [<a href="%s">tarball</a>]\n' "${_i}"
- printf ' [<a href="%s.sig">pgp</a>]\n' "${_i}"
+ printf ' [<a href="%s.sha512">sha512</a>]\n' "${_i}"
printf ' </td>\n'
printf ' </tr>\n'
done
diff --git a/htrdr/hooks/00-sign-archives.sh b/htrdr/hooks/00-sign-archives.sh
@@ -17,19 +17,24 @@
set -e
-find downloads -name "*Starter-Pack*.tar.gz" -o -name "*.nc.xz"\
+cd downloads
+
+find . -name "*Starter-Pack*.tar.gz" -o -name "*.nc.xz"\
| sort \
| while read -r i; do
- sign="${i}.sig"
+ file="$(basename "${i}")" # Rm the "./" prefix
+
+ algo="sha512"
+ sign="${file}.${algo}"
if ! [ -f "${sign}" ]; then
- >&2 printf 'Signing %s\n' "${i}"
- gpg --yes -a -o "${sign}" --detach-sign "${i}"
+ >&2 printf 'Signing %s\n' "${file}"
+ cksum -a "${algo}" "${file}" > "${sign}"
fi
# Write the generated files to standard output to inform the build
# system which files it needs to handle during installation.
- printf '%s/%s\n' "${PWD##*/}" "${i}.sig"
+ printf '%s/%s\n' "${PWD##*/}" "${sign}"
done
diff --git a/scripts/print_downloads.sh b/scripts/print_downloads.sh
@@ -115,8 +115,8 @@ version_re="${version_re}\(-r[0-9]\{1,\}\)\{0,1\}"
fi
# Display a link to the archive signature, if it exists
- if [ -f "${i}.sig" ]; then
- printf ' [<a href="%s.sig">pgp</a>]\n' "${i}"
+ if [ -f "${i}.sha512" ]; then
+ printf ' [<a href="%s.sha512">sha512</a>]\n' "${i}"
fi
printf ' </td>\n'
done
diff --git a/solstice/hooks/00-sign-archives.sh b/solstice/hooks/00-sign-archives.sh
@@ -17,22 +17,27 @@
set -e
-find downloads \
+cd downloads
+
+find . \
-name "*.tar" \
-o -name "*.tar.gz" \
-o -name "*.tgz" \
-o -name "*.zip" \
| while read -r i; do
- sign="${i}.sig"
+ file="$(basename "${i}")" # Rm the "./" prefix
+
+ algo="sha512"
+ sign="${file}.${algo}"
if ! [ -f "${sign}" ]; then
- >&2 printf 'Signing %s\n' "${i}"
- gpg --yes -a -o "${sign}" --detach-sign "${i}"
+ >&2 printf 'Signing %s\n' "${file}"
+ cksum -a "${algo}" "${file}" > "${sign}"
fi
# Write the generated files to standard output to inform the build
# system which files it needs to handle during installation.
- printf '%s/%s\n' "${PWD##*/}" "${i}.sig"
+ printf '%s/%s\n' "${PWD##*/}" "${sign}"
done
diff --git a/solstice/solstice-resources.md b/solstice/solstice-resources.md
@@ -13,8 +13,9 @@ separate archive.
### Downloads
-- [Beginner's Guide](downloads/Solstice-ABG.pdf)
-- [Resources](downloads/Solstice-ABG-rsrc.zip)
+- Beginner's Guide: [pdf](downloads/Solstice-ABG.pdf)
+- Resources: [zip](downloads/Solstice-ABG-rsrc.zip) /
+ [sha512](downloads/Solstice-ABG-rsrc.zip.sha512)
## Post-Processes
diff --git a/stardis/hooks/00-sign-archives.sh b/stardis/hooks/00-sign-archives.sh
@@ -17,19 +17,24 @@
set -e
-find downloads -name "Stardis*.tar.gz" \
+cd downloads
+
+find . -name "Stardis*.tar.gz" \
| sort \
| while read -r i; do
- sign="${i}.sig"
+ file="$(basename "${i}")" # Rm the "./" prefix
+
+ algo="sha512"
+ sign="${file}.${algo}"
if ! [ -f "${sign}" ]; then
- >&2 printf 'Signing %s\n' "${i}"
- gpg --yes -a -o "${sign}" --detach-sign "${i}"
+ >&2 printf 'Signing %s\n' "${file}"
+ cksum -a "${algo}" "${file}" > "${sign}"
fi
# Write the generated files to standard output to inform the build
# system which files it needs to handle during installation.
- printf '%s/%s\n' "${PWD##*/}" "${i}.sig"
+ printf '%s/%s\n' "${PWD##*/}" "${sign}"
done
diff --git a/stardis/starter-pack.sh b/stardis/starter-pack.sh
@@ -48,7 +48,7 @@ while read -r i ; do
printf ' <tr>\n'
printf ' <td>%s</td>\n' "${version}"
printf ' <td>[<a href="%s">tarball</a>]\n' "${i}"
- printf ' [<a href="%s.sig">pgp</a>]\n' "${i}"
+ printf ' [<a href="%s.sha512">sha512</a>]\n' "${i}"
printf ' </td>\n'
printf ' </tr>\n'
done
