Provide instruction to validate the checksum of ORAS CLI binaries

[FeynmanZhou]

ORAS release uses a GPG key to sign each release binaries in the release process. We should provide instructions to help users validate the checksum of ORAS CLI binaries.

[aryab2003]

I am willing to work under this project.Could you please provide me the details about this issue?

[FeynmanZhou]

@aryab2003 Thanks for your interest. However, this issue has been assigned to @deepeshaburse as she is the mentee of the LFX mentorship program.

[FeynmanZhou]

@deepeshaburse
According to the v1.0.0 release notes, it mentioned the GPG key was used to sign the ORAS release binaries:

This release was signed with BE6F A8DD A48D 4C23 0091 A0A9 276D 8A72 4CE1 C704 (@qweeah's GPG key) which can be found here.

So it has the following steps to validate the release binary using GPG. You can try it locally:

gpg --import https://github.com/qweeah.gpg // save it to a local `.gpg` file

gpg --gen-key

sign

save

gpg --edit-key qweeah trust

choose "4 = I trust fully"

gpg --verify oras_1.0.0_linux_amd64.tar.gz.asc oras_1.0.0_linux_amd64.tar.gz

[deepeshaburse]

@FeynmanZhou thanks for the input!