https://blog.donnyguo.com/en/tags/devops/Recent content in DevOps on Donny's BlogHugoen-USFri, 17 Jul 2026 10:45:00 -0400https://blog.donnyguo.com/en/blog/gpg-verification/Fri, 17 Jul 2026 10:45:00 -0400https://blog.donnyguo.com/en/blog/gpg-verification/<p>When downloading binaries or source archives from open source projects, the common practice is to &ldquo;check the hash.&rdquo; While this ensures the file wasn&rsquo;t corrupted during transit, it does nothing to prove the file was actually produced by the legitimate maintainer.</p>