Cutlery/caddy
1
0
Fork 0
mirror of https://github.com/caddyserver/caddy.git synced 2025-07-09 03:04:57 -04:00
Code Issues Actions Packages Projects Releases Wiki Activity

Created Verifying Archive Signatures (markdown)

Matt Holt 2017-04-22 17:22:26 -06:00
parent 850e3554f7
commit 58b4cb6cb9
1 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
Verifying-Archive-Signatures.md Normal file

@ -0,0 +1,23 @@
[Caddy's download page](https://caddyserver.com/download) distributes Caddy in an archive file with several files inside it, one of them being the `caddy(.exe)` binary. Because the build server also signs its builds with Caddy's private key, you can verify that your download has not been tampered with or corrupted. This check is performed with gpg.
Make sure you've downloaded both the Caddy archive file and its associated signature using these links on the Download page:
![Download links](https://i.imgur.com/yPB7KEF.png)
Make sure [Caddy's public key](https://keybase.io/caddy) is in your keyring and is trusted. Then you can verify the downloaded file against the signature:
```bash
gpg --verify caddy_archive_file.asc caddy_archive_file
```
Replace "caddy_archive_file" with the name of the archive file you downloaded.
If you see something like this:
```plain
gpg: Signature made Thu Apr 20 11:58:34 2017 MDT using RSA key ID CA56EA34
gpg: Good signature from "Caddy Web Server <contact@caddyserver.com>"
```
Then you're good to go!