01/05: doc: Mention how to verify signatures.

[Ludovic Courtès]

civodul pushed a commit to branch master
in repository guix.

commit daa8922abc63b2491490ad1898b613f5653a19b1
Author: Ludovic Courtès <address@hidden>
Date:   Fri Jan 1 19:01:05 2016 +0100

    doc: Mention how to verify signatures.
    
    * doc/guix.texi (Binary Installation): Be more precise about signature
    verification.  Suggested by Carl Hansen <address@hidden>.
---
 doc/guix.texi |   26 +++++++++++++++++++++-----
 1 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/doc/guix.texi b/doc/guix.texi
index 5cdbc5d..7fac99c 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -312,11 +312,27 @@ Installing goes along these lines:
 @enumerate
 @item
 Download the binary tarball from
address@hidden://alpha.gnu.org/gnu/guix/address@hidden@address@hidden
-usual, make sure to download the associated @file{.sig} file and to
-verify the authenticity of the tarball against it!}, where @var{system}
-is @code{x86_64-linux} for an @code{x86_64} machine already running the
-kernel Linux, and so on.
address@hidden://alpha.gnu.org/gnu/guix/address@hidden@var{system}.tar.xz},
+where @var{system} is @code{x86_64-linux} for an @code{x86_64} machine
+already running the kernel Linux, and so on.
+
+Make sure to download the associated @file{.sig} file and to verify the
+authenticity of the tarball against it, along these lines:
+
address@hidden
+$ wget ftp://alpha.gnu.org/gnu/guix/address@hidden@var{system}.tar.xz.sig
+$ gpg --verify address@hidden@var{system}.tar.xz.sig
address@hidden example
+
+If that command fails because you don't have the required public key,
+then run this command to import it:
+
address@hidden
+$ gpg --keyserver keys.gnupg.net --recv-keys 3D9AEBB5
address@hidden example
+
address@hidden
+and rerun the @code{gpg --verify} command.
 
 @item
 As @code{root}, run: