On 4 Oct 2014 13:52, "Charles Bos" wrote:

Hi,

It's possible to calculate the checksums yourself. Just install the

openssl

package and then run the following:

$ openssl sha256 filename.tar.gz

(with filename.tar.gz being the name of the source tarball that you're using)

Hope this helps

Or just use sha256sum or md5sum. Not sure which package they live in, but I suspect they come with the base development packages. /M

On 4 October 2014 11:54, stef204 wrote:

...

Hi, Working only on my second AUR package, please bear with me. To verify integrity, the author does not provide checksums but only a gpg .asc file. What is the preferred way for me to proceed? The author is active and available so I can ask him to post a sha256 on his website; but I'm trying not to be too demanding, preferring to keep my requests on the subject of the application itself, e.g. features, etc. It's not a big deal but just wanted to check with the community here in case I am missing something. Thanks.

...

Use GPG to verify the integrity of the download and calculate the checksum locally for yourself. Users of your package have to trust you anyway, as you can basically do anything to your package, anyway.

Best regards, Karol Babioch

OK, you have a point, understood.

For reference, a PGP signature is a hash of the file encrypted with the public key, so that people that have the public key can decrypt the hash and verify that the file they have is the one that upstream published. -- Sincerely, Johannes Löthberg PGP Key ID: 0x50FB9B273A9D0BB5 https://keybase.io/johannes

04.10.2014, 06:38, "Levente Polyak" :

If you want a even more convenient solution, you can also simply call 'updpkgsums' (after the gpg verification) in the current directory containing the PKGBUILD in question. This will update the existing hash in your PKGBUILD (but its recommended to check the gpg integrity before doing so).

  cd your-package-directory   updpkgsums

Thanks Levente. All is clear on this issue.