From d9d1c1d60da31d161f4ccf3ffefca0e1070a8777 Mon Sep 17 00:00:00 2001 From: m5r Date: Tue, 20 Oct 2026 14:57:27 +0200 Subject: [PATCH] docs: verify-a-release transcripts elide the signing key's email address --- docs/how-to/verify-a-release.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/how-to/verify-a-release.md b/docs/how-to/verify-a-release.md index 07e1fb3..0d02b9c 100644 --- a/docs/how-to/verify-a-release.md +++ b/docs/how-to/verify-a-release.md @@ -97,7 +97,7 @@ curl -fsSL https://keys.openpgp.org/vks/v1/by-fingerprint/A2061F6AB24DF2C0E92346 ``` > Verified: the key is published, and that exact `curl | gpg --import` reported -> `key 1509B54946D08A95: public key "Mokhtar Mial (pc) " +> `key 1509B54946D08A95: public key "Mokhtar Mial (pc) <…>" > imported` into a clean `GNUPGHOME`. Then verify: @@ -109,7 +109,7 @@ gpg --verify SHA256SUMS.txt.asc SHA256SUMS.txt ``` gpg: Signature made Sun 09 Aug 2026 01:26:42 AM CEST gpg: using EDDSA key 019D00DF8417EBFDA5471E5EF7319CC024FB5A96 -gpg: Good signature from "Mokhtar Mial (pc) " [unknown] +gpg: Good signature from "Mokhtar Mial (pc) <…>" [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: A206 1F6A B24D F2C0 E923 46FD 1509 B549 46D0 8A95 @@ -134,7 +134,7 @@ A tampered `SHA256SUMS.txt` looks like this, and exits 1: ``` gpg: Signature made Sun 09 Aug 2026 01:26:42 AM CEST gpg: using EDDSA key 019D00DF8417EBFDA5471E5EF7319CC024FB5A96 -gpg: BAD signature from "Mokhtar Mial (pc) " [unknown] +gpg: BAD signature from "Mokhtar Mial (pc) <…>" [unknown] ``` > Verified against `v0.0.1`, from a clean `GNUPGHOME` holding only the imported