search

ricochet-im / website

The website at ricochet.im
6 stars 3 forks source link

Signed build info on homepage #2

Open special opened 9 years ago

special commented 9 years ago

@taoeffect points out that there is no mention of how to get or verify PGP signatures on the website; that should be improved.

See also https://github.com/ricochet-im/ricochet/issues/268

pkirkovsky commented 8 years ago

@special Are your release deployment scripts available on Github? I'm not sure if it's possible to add this feature with Hugo alone.

special commented 8 years ago

I don't have any special script for deploying website releases - it's just a Hugo build synced to the public server.

I don't think we need any particular features. We mostly just need to find the right way to link to the PGP signatures and inform people about how to verify them.

One option I like is a post-download page that the user is sent to as the download starts. That would be a great place to explain PGP and teach them how to install and set up Ricochet.

pkirkovsky commented 8 years ago

I like your post-download page idea. Additionally, I think it would be really great to have GPG sigs & checksums below the download links so advanced users can quickly verify downloads.

How do you update the download links on the main page? If that process is automated, it could be used to post GPG sigs and checksums.

Another option is to package the software package into a a wrapper archive and include a .sig file inside that.