Files
rclone/docs/content
Nick Craig-Wood 204adfeedc docs: fix release verification instructions trusting unsigned hashes
The manual release verification steps checked the signature with gpg
--verify and then checked the binaries against the whole SHA256SUMS
file. gpg only verifies the clearsigned part, so an unsigned hash line
added outside it would be used by sha256sum -c or by rclone hashsum -C.

The instructions now extract the signed hashes with gpg --decrypt and
check the binaries against those only.

See: GHSA-w33h-3qgq-8mv8
2026-10-08 22:49:33 +01:00
..
2026-07-31 16:56:33 +01:00
2026-10-08 16:51:58 +01:00
2026-07-31 16:56:33 +01:00
2026-07-31 16:56:33 +01:00
2026-07-31 16:56:33 +01:00
2026-10-08 11:16:10 +01:00
2026-04-02 16:32:54 +01:00
2026-07-31 16:56:33 +01:00
2026-07-31 16:56:33 +01:00
2026-01-23 16:55:52 +00:00
2026-05-01 15:56:56 +01:00
2026-05-01 15:56:56 +01:00
2026-07-31 16:56:33 +01:00
2026-04-02 16:32:54 +01:00
2026-07-31 16:56:33 +01:00
2026-07-31 16:56:33 +01:00
2026-09-21 14:09:21 +01:00
2026-04-02 16:32:54 +01:00
2026-07-31 16:56:33 +01:00
2026-07-31 16:56:33 +01:00
2026-07-31 16:56:33 +01:00
2026-07-31 16:56:33 +01:00
2026-07-31 16:56:33 +01:00
2026-07-31 16:56:33 +01:00
2026-04-21 21:06:49 +02:00
2026-05-01 15:56:56 +01:00
2026-07-31 16:56:33 +01:00
2026-07-31 16:56:33 +01:00
2026-10-06 12:23:02 +01:00
2026-07-31 16:56:33 +01:00
2026-04-02 16:32:54 +01:00
2026-09-10 16:57:15 +01:00
2026-07-31 16:56:33 +01:00