Reworked the download page to link from "add this key to your apt

configuration" to the /archive-key page, pushing the SecureApt
reference link into that page. This has a streamlining affect on new
users wanting to get started as it links directly to the archive-key
page where there are explicit instructions for how to do the archive
key verification and then the follow-up add to the apt keyring for
proper archive/package verification. The way it was before, you were
given the link to the more general SecureApt debian wiki page, which
was a lot of information, when in most cases people just want to know
what steps they need to know to do the verification/addition. However,
the link to the SecureApt page is valuable to reference, it just makes
more sense to be embedded in the page which explicitly deals with
that.

This also means I added information about how to add the key to the
apt keyring into the archive-key page. In doing so, I removed the
dkg-specific prompt (not because I dont like it, but because it would
have been funny for me to add more commands and have to manually
construct his prompt to maintain consistency on the page). Also, added
some output of commands so people have an idea what to expect.

diff --git a/website/archive-key.mdwn b/website/archive-key.mdwn
index 45ac86e2853aaeb306b402b4641bf817cabc1a12..6658469a5609407ca9008134fd24cdf15e45f7c0 100644 (file)
--- a/website/archive-key.mdwn
+++ b/website/archive-key.mdwn
@@ -4,30 +4,44 @@
 ## Verifying the key ##
 
 The [Monkeysphere apt repository](/download) is signed by this key, so
-you can verify that the packages come from the right place and have
-not been tampered with.
+you [can verify](http://wiki.debian.org/SecureApt) that the packages
+come from the right place and have not been tampered with.
 
 This key is certified by several of the Monkeysphere developers, and
 should be able to be found from the public keyservers with:
 
-       gpg --keyserver $KEYSERVER --recv EB8AF314
+       $ gpg --recv-key EB8AF314
+       gpg: requesting key EB8AF314 from hkp server pool.sks-keyservers.net
+       gpg: key EB8AF314: public key "Monkeysphere Archive Signing Key (http://archive.monkeysphere.info/debian)" imported
+       gpg: no ultimately trusted keys found
+       gpg: Total number processed: 1
+       gpg:               imported: 1  (RSA: 1)
+       $
 
 You should be able to verify the fingerprint like this:
 
-       [0 dkg@squeak ~]$ gpg --list-key --fingerprint http://archive.monkeysphere.info/debian
+       $ gpg --list-key --fingerprint http://archive.monkeysphere.info/debian
        pub   4096R/EB8AF314 2008-09-02 [expires: 2009-09-02]
              Key fingerprint = 2E8D D26C 53F1 197D DF40  3E61 18E6 67F1 EB8A F314
        uid       [  full  ] Monkeysphere Archive Signing Key (http://archive.monkeysphere.info/debian)
-       
-       [0 dkg@squeak ~]$ 
+       $ 
 
-And you can verify the fingerprints with:
+And you can also verify the fingerprints with:
  
-       gpg --list-sigs http://archive.monkeysphere.info/debian
+       $ gpg --list-sigs http://archive.monkeysphere.info/debian
 
 If you believe that the repository has been tampered with, please [let
 us know](/community)!
 
+If you have properly verified this key, you can add it to your apt
+keyring for proper cryptographic verification of the archive and its
+packages by doing the following:
+
+        $ sudo gpg -a --export EB8AF314 | apt-key add -
+        OK
+        $ aptitude update
+        ...
+
 ## The key itself ##
 
 <pre>

diff --git a/website/download.mdwn b/website/download.mdwn
index 5551b52985f21ecbfda75417bdc3e310a7513df3..1f27fde4508ce58d252a5089549b68de0e34256e 100644 (file)
--- a/website/download.mdwn
+++ b/website/download.mdwn
@@ -13,12 +13,11 @@ You can add this repo to your system by putting the following lines in
        deb http://archive.monkeysphere.info/debian experimental monkeysphere
        deb-src http://archive.monkeysphere.info/debian experimental monkeysphere
 
-The repository is currently signed by [The Monkeysphere archive
-signing key](/archive-key), key id EB8AF314 (fingerprint: `2E8D
+The repository is currently signed by the Monkeysphere archive
+signing key, key id EB8AF314 (fingerprint: `2E8D
 D26C 53F1 197D DF40 3E61 18E6 67F1 EB8A F314`).  To cryptographically
 verify the packages, you'll want to [add this key to your apt
-configuration after verifying its
-integrity](http://wiki.debian.org/SecureApt).
+configuration after verifying its integrity](/archive-key).
 
 To use the `monkeysphere subkey-to-ssh-agent` subcommand, you will
 also need [version 2.6 of GnuTLS](/news/gnutls-2.6-enables-monkeysphere),