Update verifying_builds.md

[bartero]

I have just learned, that the Lineage team has changed the way they sign the public builds.

I got to know why the keytool keep telling me: Not a signed jar file from this post.

Please update your wiki page! :-)

[brad2014]

Also: the update_verifier uses an embedded public key, but I don't see any way to get a fingerprint of that key that is posted to a public site (as was done with the old method at https://wiki.lineageos.org/verifying-builds.html).

What is the advantage of the new approach? Using the signed jar file inspired a lot of confidence because it is such a well-known method, and easy to test using a tool (keytool) from outside the site of the code we're validating.

[htgoebel]

I suggest dropping the old instructions completely. There is no use in carrying sold stuff. The new way seems to work for old archives, too. (t least for the archive I've tested.)

Anyway the new instructions have several issues:
a) the pip install command as shown tries to install system-wide, thus it needs to be run as root (or --user needs to be passed
b) this will pollute the system's respective the user's environment, which might not be desired
c) on Windows pip might not be on the path (see this talk)

Preferable and recommended way is to use a virtual environment:

git clone https://github.com/LineageOS/update_verifier
cd update_verifier
python3 -m venv .
bin/pip install -r requirements.txt
bin/python update_verifier.py lineageos_pubkey /path/to/zip

[htgoebel]

@brad2014 I described the way to re-establish the chain of trust after the way to verify public builds has changed here: https://www.goebel-consult.de/blog/really-verifying-lineageos-build-authenticity

[bartero]

@htgoebel Thank you for your effort!
I will look at it later today

[xaverdh]

On a side note, why aren't the builds just signed with gpg (e.g. with a detached signature) ?
Maybe thats because I am from the "desktop linux" world, but that looks like the standard procedure to me.

[htgoebel]

@ItzLevvie review.lineageos.org forcefully requires to have a google account - which excludes me from contributing.

[htgoebel]

@haggertk Has this been solved, or why has this been closed?

Closing issue without stating why is not a honest style and able to discourage contributors.

[htgoebel]

@ItzLevvie Many thanks.