From 7501e6905ac5ae7a2fa3d27e5fc8d7882ceb87f9 Mon Sep 17 00:00:00 2001
From: random-zebra <random.zebra@protonmail.com>
Date: Mon, 19 Nov 2018 10:58:49 +0100
Subject: [PATCH] add gpg verification to installation.md

---
 docs/installation.md | 38 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 37 insertions(+), 1 deletion(-)

diff --git a/docs/installation.md b/docs/installation.md
index 812e160..d9ad31b 100644
--- a/docs/installation.md
+++ b/docs/installation.md
@@ -18,7 +18,43 @@ python3 spmt.py
 <br>
 
 
-#### Setting up the Masternode VPS
+#### Verifying the binaries
+It's always advised to use the provided signature *asc* files to verify the authenticity of the downloaded package and confirm it has been signed by the author (Keybase user: [random_zebra](https://keybase.io/random_zebra/)).
+
+__To verify the signature (with keybase app)__:
+```
+keybase pgp verify -d <detached signature file> -i <downloaded archive> -S random_zebra
+```
+e.g.
+```
+keybase pgp verify -d SPMT-v0.3.2a-x86_64-gnu_linux.tar.gz.asc -i SPMT-v0.3.2a-x86_64-gnu_linux.tar.gz -S random_zebra
+```
+
+__To verify it (without keybase app)__:
+- Download signing key
+
+```
+curl https://keybase.io/random_zebra/pgp_keys.asc?fingerprint=ed501a1c26ce0733c33d6b00e7d8bf3b03d710a1 > random_zebra-PUBKEY.asc
+```
+- Import key 
+
+```
+gpg --import random_zebra-PUBKEY.asc
+```
+- Verify the downloaded archive with its detached signature file:
+
+```
+gpg --verify <detached signature file> <downloaded archive>
+```
+
+e.g.
+```
+gpg --verify SPMT-v0.3.2a-x86_64-gnu_linux.tar.gz.asc SPMT-v0.3.2a-x86_64-gnu_linux.tar.gz
+```
+
+<br>
+
+### Setting up the Masternode VPS
 
 To setup the remote node follow the steps described here:
 [VPS Setup Guide](vpsguide.md)