-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

== Date ==
This release was made the 07 February 2023 by Denis 'GNUtoo' Carikli.

== Introduction ==
At the time of writing, Debian 9 (stretch) is still the only GNU/Linux
distribution that can build Replicant 6.0.

It has python 3.5.3. Recent repo versions require at least python 3.6.

Using older repo versions is very impractical as repo tends to update
itself when using 'repo sync'.

Because of that we also provide a self contained version of repo that also
contains all the dependencies it needs, including python.

This way people wanting to build Replicant can simply install that version
of repo on top of Debian 9 or other GNU/Linux distributions.

== How to verify this release ==
It's a good practice to verify software releases. It enables to detect corrupted
downloads and sometimes even attacks[1].

All the technical information needed to verify the tarball is included in
this file.

This way, all the important information like the release date, how to build
and install it and so on is also authenticated.

Without that, an attacker can also rename an older release that has been signed
by the same person and make people think that it's the new release. That could
be an issue if one day security issues are found in older releases.

To do that you first need to download the GPG key of the person that prepared
the release:
    gpg --recv-key FB31DBA3AB8DB76A4157329F7651568F80374459

You then need to verify this README file with the following command:
    gpg --verify README.txt

It should says "Good signature", and look similar to this output:
    gpg: Signature made jeu. 28 janv. 2021 12:38:15 CET
    gpg:                using RSA key 782F9DDBE36BA7F3D4DE49065F5DFCC14177E263
    gpg: Good signature from "Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>" [undefined]
    gpg: WARNING: This key is not certified with a trusted signature!
    gpg:          There is no indication that the signature belongs to the owner.

Once this is done you can verify the released archive.

As this file (README.txt) contains a checksum at the end, you can simply run
this command to check the tarball:
    sha512sum -c --ignore-missing README.txt
It should then say "OK", and the output will be somewhat similar to this one:
    31b707cf5d179eb664df26b72f0f2976ef28f41d-tarball-pack.tar.xz: OK
    sha512sum: WARNING: 105 lines are improperly formatted

References:
- -----------
[1]https://www.leviathansecurity.com/blog/the-case-of-the-modified-binaries/

== Installation ==
The tarball needs to be decompressed in / as root. Once you are root, you
can simply uncompress it with the following command:
    tar xf path/to/somehash-tarball-pack.tar.xz -C /

It will install all its dependencies in /gnu/ and install repo and repo-env.sh
in /usr/local/bin/.

== Usage ==
Once installed, that repo version will need some environment variables to be
set to find its SSL / TLS certificates. To do that you can run this command
in the current terminal:
    source /usr/local/bin/repo-env.sh
You can then use repo as usual, in that same terminal. For instance:
    repo sync

When building Replicant it would be a good idea to open a new terminal not to
have the environment variables of repo interfere with the build, as the build
was never tested with such environment variables set.

== How was that tarball made ==
The tarball was made with Guix[1], on an x86_64 computer with the following
commands:
    guix pull
    guix time-machine \
    --branch=master \
    --commit=31b707cf5d179eb664df26b72f0f2976ef28f41d -- \
    pack \
    --compression=xz \
    --save-provenance \
    -RR \
    --symlink=/usr/local/bin/repo=bin/repo \
    --symlink=/usr/local/bin/repo-env.sh=etc/profile \
    git-repo le-certs nss-certs git python-certifi

Since --save-provenance is used, it also contains a manifest file that can
be used to recreate the exact same tarball. As it is the only file named
manifest in that tarball, once it is installed, you can find it with the
following command:
    find /gnu -name manifest

References:
- -----------
[1]https://guix.gnu.org/

== Checksums ==
b67284252c296a5ce8892dba32eebd42dbd7df51d8163d8468de4dd025103b18db3a57cbf6d8532d2a4af0dd59740b7b774f74982b4df7cb6e6cd56bc9bb060b  31b707cf5d179eb664df26b72f0f2976ef28f41d-tarball-pack.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEeC+d2+Nrp/PU3kkGX138wUF34mMFAmPilxYACgkQX138wUF3
4mNgXw/9G+y1jJ/G/Lxlv+CkswRVI8ITcLtPFvH3VejNPp9kyz//Crog2xtnK8Hk
1OpN7OY9rOhS0kJ8OD6gDTq1Gzk4kzedlFG+u1Jxw0YFqiRKhnZl4xnLXlW2Q+Mr
jgWpKfbTM+l3s08ow660EXzKsZpHl7ahQQOotcUxrRkOQfWWkuvOYtIvdlD+vUnK
MPb4DgvPZ+OT8R5DgMTAiO4TY9WcXP2vSuYfi0dsyzmB+71de3iQGT2Ij6WUdLbC
WSN1CX0qW+wpeqdQAZhG0Qjg5lPxggI0fr/LCJp0WwIurygWNNVqoUt2fGuXAPDS
o1iPgOd8xq/UYJeMw3Qe1wgmX2L1CBmSaKL88rYXhxDdwBkszzHSRvtv1LMLaf8P
qhBj10chm4h+PzzYBfupilR7UgkeWp9VRW8iH5Owx90me9DCqA22y608JCz3Noc5
wrqZE9fmtViSMRJ+mpWtjZ+xxEuWK9mLMrCOpHDEvnuiVod9JUVBZ9wcAZ9kVbH7
ooD8y+4cegLwwvOhIlVg/33no6thWBG2r2hd22pSbh+xPYnh6VZxW1hbi6Ooc7GF
j8MJgtJX71lGRgvsBpW/nttJKY+wbkgpZVRK9bAdoqUMH4Ry4BUcUni0E+Pje9nK
Eb1W3sv4duO+kuY+HP4eNQlnu7npVki54WRb+mEUbq4ixnEKPsI=
=DCVl
-----END PGP SIGNATURE-----