doc: update the instruction on how to verify releases #59113
+19
−23
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
/cc @nodejs/tsc @nodejs/releasers |
MikeMcC399
reviewed
Jul 19, 2025
This was referenced Jul 19, 2025
MikeMcC399
reviewed
Jul 19, 2025
MikeMcC399
reviewed
Jul 19, 2025
MikeMcC399
reviewed
Jul 19, 2025
Comment on lines
+107
to
+108
| Alternatively, you can import the releaser keys in your default keyring, see | ||
| [Release keys](#release-keys) for commands to how to do that. |
There was a problem hiding this comment.
The release keys section only contains commands to import individual keys from the gpg-only-active-keys set, so it is not a substitute for importing from /gpg/pubring.kbx. There are no commands listed for keys in the section "Other keys used to sign some previous releases".
Maybe say here something like "you can import only the primary PGP releaser keys ..."
Co-authored-by: Mike McCready <[email protected]>
aduh95
commented
Jul 19, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes: #58904
Currently, the only documented way relies on third-party server, albeit a well-trusted one, but one that the project doesn't control, and one that's not very convenient to use for consumers. Instead, let's document nodejs/release-keys as the trusted source of truth when it comes to verifying Node.js releases.
I'm keeping the instructions on how to download the keys from key.openPGP.org as some tools out there might be scraping our README looking for that, and it's still a valid way to get the release keys, simply not the preferred one.