commit 562d571c78270e2c17ec8136ba59ab3446db01b0 Author: Damian Johnson atagar@torproject.org Date: Sun Sep 6 16:51:55 2020 -0700

File and signature documentation

I bundled our tarball and signature under PyPI as an afterthought. Expanding this into its own listing with FAQ instructions for how to validate. --- docs/_static/label/file.png | Bin 0 -> 678 bytes docs/_static/label/resources/file.xcf | Bin 0 -> 1893 bytes docs/_static/section/download/file.png | Bin 0 -> 8278 bytes docs/download.rst | 41 ++++++++++++++++++++++++++------ docs/faq.rst | 42 +++++++++++++++++++++++++++++++++ 5 files changed, 76 insertions(+), 7 deletions(-)

diff --git a/docs/_static/label/file.png b/docs/_static/label/file.png new file mode 100644 index 00000000..a28d2a38 Binary files /dev/null and b/docs/_static/label/file.png differ diff --git a/docs/_static/label/resources/file.xcf b/docs/_static/label/resources/file.xcf new file mode 100644 index 00000000..3e7b6366 Binary files /dev/null and b/docs/_static/label/resources/file.xcf differ diff --git a/docs/_static/section/download/file.png b/docs/_static/section/download/file.png new file mode 100644 index 00000000..2d6259ec Binary files /dev/null and b/docs/_static/section/download/file.png differ diff --git a/docs/download.rst b/docs/download.rst index a6a35870..d7582894 100644 --- a/docs/download.rst +++ b/docs/download.rst @@ -59,6 +59,12 @@ Download Source: https://www.netbsd.org/gallery/logos.html License: https://www.netbsd.org/about/redistribution.html

+ * File + Source: NuoveXT (http://nuovext.pwsp.net/) + Author: Alexandre Moore (http://sa-ki.deviantart.com/) + License: GPL v2 + File: NuoveXT/128x128/mimetypes/gnome-mime-application-x-archive.png + * Git Source: https://en.wikipedia.org/wiki/File:Git-logo.svg Author: Jason Long @@ -106,8 +112,10 @@ Download .. image:: /_static/label/debian.png :target: https://packages.debian.org/sid/python-stem

- Packages by Dererk for Debian, including `python-stem - https://packages.debian.org/sid/python-stem`_ (for Python 2.x) and + Packages maintained by `Dererk + https://nm.debian.org/person/dererk/`_ for Debian + include `python-stem https://packages.debian.org/sid/python-stem`_ + (for Python 2.x) and `python3-stem https://packages.debian.org/sid/python3-stem`_ (for Python 3.x).

@@ -135,8 +143,9 @@ Download .. image:: /_static/label/fedora.png :target: https://apps.fedoraproject.org/packages/python-stem

- Packages maintained by Juan for Fedora using **dnf** or **yum**. These - include **python-stem** (for Python 2.x), **python3-stem** (for Python + Packages maintained by `Juan + https://fedoraproject.org/wiki/User:Jorti`_ for Fedora include + **python-stem** (for Python 2.x), **python3-stem** (for Python 3.x), and **python-stem-doc** (this website).

:: @@ -150,7 +159,9 @@ Download .. image:: /_static/label/gentoo.png :target: http://packages.gentoo.org/package/net-libs/stem

- Package by Anthony Basile for Gentoo. + Package by `Anthony Basile + https://packages.gentoo.org/maintainer/blueness@gentoo.org`_ for + Gentoo.

::

@@ -176,8 +187,8 @@ Download .. image:: /_static/label/slackware.png :target: https://slackbuilds.org/repository/14.2/python/stem/

- Package by Markus for `Slackware - http://slackbuilds.org/howto/`_. + Package by `Markus https://docs.slackware.com/wiki:user:markush`_ for + `Slackware http://slackbuilds.org/howto/`_.

* - .. image:: /_static/section/download/freebsd.png :target: http://www.freshports.org/security/py-stem/ @@ -218,6 +229,22 @@ Download

% pkg_add py37-stem

+ * - .. image:: /_static/section/download/file.png + :target: https://files.pythonhosted.org/packages/7f/71/d82f4204e88be00220cc54eedb2972... + + - .. _file: + .. image:: /_static/label/file.png + :target: https://files.pythonhosted.org/packages/7f/71/d82f4204e88be00220cc54eedb2972... + + `File + https://files.pythonhosted.org/packages/7f/71/d82f4204e88be00220cc54eedb2972fd05081cb0e5ebdc537d8940b064ea/stem-1.7.1.tar.gz`_ + and `signature https://files.pythonhosted.org/packages/7f/71/d82f4204e88be00220cc54eedb2972fd05081cb0e5ebdc537d8940b064ea/stem-1.7.1.tar.gz.asc`_ upon which the above packages are based (`instructions <faq.html#how-do-i-validate-the-pgp-signature>`_). You + can directly install from this with... + + :: + + % pip install stem-1.7.1.tar.gz + * - .. image:: /_static/section/download/git.png :target: https://gitweb.torproject.org/stem.git

diff --git a/docs/faq.rst b/docs/faq.rst index e10a0c6f..7df2dd51 100644 --- a/docs/faq.rst +++ b/docs/faq.rst @@ -91,6 +91,48 @@ Stem works with **Python 3.6 and greater**. If you require a deprecated Python version then please use Stem 1.8, which was compatible with **Python 2.6 and above**.

+.. _how_do_i_validate_the_pgp_signature: + +How do I validate the PGP signature? +------------------------------------ + +Most `download options <download.html>`_ are maintained by their +operating system's community. Stem's author only provides `PyPI +<download.html#pypi>`_, `File <download.html#file>`_, and `Source +<download.html#source>`_. + +Releases are `PGP signed https://en.wikipedia.org/wiki/Pretty_Good_Privacy`_ +and can be validated with the `author's key +https://www.atagar.com/pgp.html`_... + +#. `Install GPG https://gnupg.org/`_ if you don't already have it. + +#. Download Stem's `latest release and signature <download.html#file>`_. + +#. Get the `key https://www.atagar.com/pgp.html`_ of Stem's author... + + :: + + % gpg --keyserver keyserver.ubuntu.com --recv-keys 0x9ABBEEC6 + gpg: requesting key 9ABBEEC6 from hkp server keyserver.ubuntu.com + gpg: key 9ABBEEC6: public key "Damian Johnson (www.atagar.com) atagar1@gmail.com" imported + gpg: no ultimately trusted keys found + gpg: Total number processed: 1 + gpg: imported: 1 (RSA: 1) + +#. Validate the downloaded file with the signature... + + :: + + % gpg --verify stem-1.7.1.tar.gz.asc stem-1.7.1.tar.gz + gpg: Signature made Wed 26 Dec 2018 03:00:43 PM PST using RSA key ID 87F30690 + gpg: Good signature from "Damian Johnson (www.atagar.com) atagar1@gmail.com" + gpg: aka "Damian Johnson atagar@torproject.org" + gpg: WARNING: This key is not certified with a trusted signature! + gpg: There is no indication that the signature belongs to the owner. + Primary key fingerprint: 6827 8CC5 DD2D 1E85 C4E4 5AD9 0445 B7AB 9ABB EEC6 + Subkey fingerprint: 2AE2 24F5 C424 990A E520 6C85 8884 04C1 87F3 0690 + .. _can_i_interact_with_tors_controller_interface_directly:

Can I interact with Tor's controller interface directly?