~ruther/guix-local

308c08d37168c5e47b581e372438c4579ef2a1f7 — Ricardo Wurmus 8 years ago 697e341
doc: Move paragraph about signature verification to the top.

* doc/contributing.texi (Submitting Patches): Remind contributors to verify
cryptographic signatures at the very beginning.
1 files changed, 6 insertions(+), 6 deletions(-)

M doc/contributing.texi
M doc/contributing.texi => doc/contributing.texi +6 -6
@@ 309,6 309,12 @@ please run through this check list:

@enumerate
@item
If the authors of the packaged software provide a cryptographic
signature for the release tarball, make an effort to verify the
authenticity of the archive.  For a detached GPG signature file this
would be done with the @code{gpg --verify} command.

@item
Take some time to provide an adequate synopsis and description for the
package.  @xref{Synopses and Descriptions}, for some guidelines.



@@ 336,12 342,6 @@ updates for a given software package in a single place and have them
affect the whole system---something that bundled copies prevent.

@item
If the authors of the packaged software provide a cryptographic
signature for the release tarball, make an effort to verify the
authenticity of the archive.  For a detached GPG signature file this
would be done with the @code{gpg --verify} command.

@item
Take a look at the profile reported by @command{guix size}
(@pxref{Invoking guix size}).  This will allow you to notice references
to other packages unwillingly retained.  It may also help determine