From 7f93e6102a3720b21cdaee1278437382b2900857 Mon Sep 17 00:00:00 2001
From: Cem Keylan <cem@ckyln.com>
Date: Wed, 7 Apr 2021 10:32:09 +0300
Subject: update installation manual

---
 carbslinux.org | 46 +++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 43 insertions(+), 3 deletions(-)

(limited to 'carbslinux.org')

diff --git a/carbslinux.org b/carbslinux.org
index 0cbe33b..05ad080 100644
--- a/carbslinux.org
+++ b/carbslinux.org
@@ -13,6 +13,11 @@ are used for assigning IDs to contribution guidelines.
 #+MACRO: contid [@@texinfo:@anchor{$1}@@$1]
 #+MACRO: sectid $2 [@@texinfo:@anchor{$1}@@$1]
 
+#+NAME: pubkey
+#+begin_src sh :exports none
+PUBKEY=carbslinux-2021.04.pub
+#+end_src
+
 This is the full documentation of [[https://carbslinux.org][Carbs Linux]], from the details of the
 distribution, installation, to the package manager. It is not yet complete.
 
@@ -150,14 +155,49 @@ sha256sum -c carbs-rootfs.tar.xz.sha256
 :END:
 
 It is highly recommended to verify the signature of the tarball. You will need
-GPG for this.
+the OpenBSD tool =signify(1)= for this. Many distributions provide a package for
+it, if you are using a Carbs Linux host, you can also install the package
+=otools= which provides =signify=. Download the signature first.
 
 #+BEGIN_SRC sh
 wget $URL/carbs-rootfs.tar.xz.sig
-gpg --recv-keys FF484BDFEFCEF8FF
-gpg --verify carbs-rootfs.tar.xz.sig
 #+END_SRC
 
+The signature file should say something similar to
+
+#+begin_src sh :exports results :results verbatim
+curl -L https://dl.carbslinux.org/releases/x86_64/carbs-rootfs.tar.xz.sig
+#+end_src
+
+#+RESULTS:
+: untrusted comment: verify with carbslinux-2021.04.pub
+: RWTBBPDVQ+aHB3dme2Kerf8XY+vWkIISp7Za2ufKghtlnRXPyObAQQyvEJYrwMVTaCBlPEnSWcnHQz8Nka06YVOIeextNKZY3AQ=
+
+Grab the key (which probably should be the latest one) that is written on the
+file from [[https://dl.carbslinux.org/keys/]] so you can verify the signature. The
+latest Signify public key is also available on the [[https://git.carbslinux.org/repository][package repository]], so you can
+check the validity of the public key from multiple locations, or just copy paste
+that portion to a file and use that instead.
+
+#+begin_src sh :noweb yes
+<<pubkey>>
+wget https://dl.carbslinux.org/keys/$PUBKEY
+#+end_src
+
+You can now verify the distribution tarball with signify.
+
+#+begin_src sh
+signify -V -m carbs-rootfs.tar.xz -p $PUBKEY
+#+end_src
+
+If everything went alright, this should output:
+
+#+begin_example
+Signature Verified
+#+end_example
+
+
+
 *** Extracting the tarball
 :PROPERTIES:
 :DESCRIPTION: Extracting the root filesystem to the desired location
-- 
cgit v1.2.3