diff options
Diffstat (limited to 'docs/release-verification.md')
| -rw-r--r-- | docs/release-verification.md | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/docs/release-verification.md b/docs/release-verification.md index 408bab9..b8eaf5e 100644 --- a/docs/release-verification.md +++ b/docs/release-verification.md | |||
| @@ -81,6 +81,14 @@ Publish, alongside the assets, `SHA256SUMS` and `SHA256SUMS.asc`, and update | |||
| 81 | is ever rotated, announce the new fingerprint clearly and update the embedded | 81 | is ever rotated, announce the new fingerprint clearly and update the embedded |
| 82 | key in `verify-release.sh`. | 82 | key in `verify-release.sh`. |
| 83 | 83 | ||
| 84 | For Windows releases with managed Tor built in, run `make windows-tor`. It | ||
| 85 | creates `Bitflash-*-windows-with-tor.zip` by downloading the Tor Expert Bundle, | ||
| 86 | checking the pinned SHA256 in `scripts/package-windows-tor.sh`, optionally | ||
| 87 | verifying the Tor Project `.asc` signature, and placing `tor/tor.exe` next to | ||
| 88 | `Bitflash.exe`. For release builds, run `TOR_VERIFY_GPG=required make | ||
| 89 | windows-tor` so the signature check is mandatory. Include that zip in | ||
| 90 | `SHA256SUMS` like any other release asset. | ||
| 91 | |||
| 84 | ## Why this matters | 92 | ## Why this matters |
| 85 | 93 | ||
| 86 | `SHA256SUMS` alone protects against a broken download, but not against someone | 94 | `SHA256SUMS` alone protects against a broken download, but not against someone |