Files
rclone/docs/content
Nick Craig-Wood 204adfeedc docs: fix release verification instructions trusting unsigned hashes
The manual release verification steps checked the signature with gpg
--verify and then checked the binaries against the whole SHA256SUMS
file. gpg only verifies the clearsigned part, so an unsigned hash line
added outside it would be used by sha256sum -c or by rclone hashsum -C.

The instructions now extract the signed hashes with gpg --decrypt and
check the binaries against those only.

See: GHSA-w33h-3qgq-8mv8
2026-10-08 22:49:33 +01:00
..
…
2026-10-08 16:51:58 +01:00
…
…
…
…
2026-10-08 11:16:10 +01:00
…
…
…
…
…
…
…
…
…
2026-09-21 14:09:21 +01:00
…
…
…
…
…
…
…
…
…
…
2026-10-06 12:23:02 +01:00
…
…
…
…
2026-09-10 16:57:15 +01:00
…
…
…
…
…
…