[llvm] [llvm][release] On release page, explain package types and verification (PR #138144)

David Spickett via llvm-commits llvm-commits at lists.llvm.org
Fri Jul 4 01:02:00 PDT 2025


https://github.com/DavidSpickett updated https://github.com/llvm/llvm-project/pull/138144

>From a8d2f10d23de34c64b7d804a50a0a2ada793dc72 Mon Sep 17 00:00:00 2001
From: David Spickett <david.spickett at linaro.org>
Date: Thu, 1 May 2025 15:02:15 +0000
Subject: [PATCH 01/14] [llvm][release] Describe types of release package

So that users can understand which they should use,
particularly for Windows.

The original text about community builds is kept as
the last part.
---
 llvm/utils/release/github-upload-release.py | 29 ++++++++++++++-------
 1 file changed, 20 insertions(+), 9 deletions(-)

diff --git a/llvm/utils/release/github-upload-release.py b/llvm/utils/release/github-upload-release.py
index 8343dee937f78..cd83628192c00 100755
--- a/llvm/utils/release/github-upload-release.py
+++ b/llvm/utils/release/github-upload-release.py
@@ -42,17 +42,28 @@ def create_release(repo, release, tag=None, name=None, message=None):
         name = "LLVM {}".format(release)
 
     if not message:
-        message = dedent(
-            """\
-            LLVM {} Release
+        # Note that these lines are not length limited because if we do so, GitHub
+        # assumes that should be how it is laid out on the page. We want GitHub to
+        # do the reflowing for us instead.
+        message = dedent("""\
+LLVM {} Release
 
-            # A note on binaries
+# Package Types
 
-            Volunteers make binaries for the LLVM project, which will be uploaded
-            when they have had time to test and build these binaries. They might
-            not be available directly or not at all for each release. We suggest
-            you use the binaries from your distribution or build your own if you
-            rely on a specific platform or configuration."""
+* If the file name starts with `LLVM-` then it is a binary release of all of LLVM for the platform at the end of the file name. For example, `LLVM-20.1.1-Linux-ARM64.tar.xz` contains LLVM binaries for Arm64 Linux.
+* If the file name starts with `clang+llvm-` then it is a binary release for the platform at the end of the filename. For example, `clang+llvm-20.1.1-armv7a-linux-gnueabihf.tar.gz` contains LLVM binaries for Armv7-a Linux.
+
+Most of the time, you will want one of the files described above.
+
+Each platform will have either an `LLVM-` package or a `clang+llvm-` package. Except for Windows which has both. For Windows, the `LLVM-` file is an installer intended for using LLVM as a toolchain. The `clang+llvm-` file contains the contents of the installer, plus libraries and tools not normally used in a toolchain.
+
+If you do not find a release package for your platform, you may be able to find a community built package on the LLVM Discourse forum thread for this release. Remember that these are built by volunteers and may not always be available.
+
+If you rely on a platform or configuration that is not one of the defaults, we suggest you use the binaries that your platform provides, or build your own release packages.
+
+* `<sub-project>*.src.tar.xz` are archives of the sources of specific sub-projects of `llvm-project` (aside from `test-suite` which is an archive of the [LLVM Test Suite](https://github.com/llvm/llvm-test-suite)).
+
+* To get all the `llvm-project` sources for this release, choose the one of the `Source Code`archives."""
         ).format(release)
 
     prerelease = True if "rc" in release else False

>From 8d085356fc46943cd2fec9744757659ec7aea2ce Mon Sep 17 00:00:00 2001
From: David Spickett <david.spickett at linaro.org>
Date: Thu, 1 May 2025 15:09:52 +0000
Subject: [PATCH 02/14] format

---
 llvm/utils/release/github-upload-release.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/llvm/utils/release/github-upload-release.py b/llvm/utils/release/github-upload-release.py
index cd83628192c00..8ad3e0671ff40 100755
--- a/llvm/utils/release/github-upload-release.py
+++ b/llvm/utils/release/github-upload-release.py
@@ -45,7 +45,8 @@ def create_release(repo, release, tag=None, name=None, message=None):
         # Note that these lines are not length limited because if we do so, GitHub
         # assumes that should be how it is laid out on the page. We want GitHub to
         # do the reflowing for us instead.
-        message = dedent("""\
+        message = dedent(
+            """\
 LLVM {} Release
 
 # Package Types

>From 3007d2660f60d7278a3d88a0c4cee7395a832283 Mon Sep 17 00:00:00 2001
From: David Spickett <david.spickett at linaro.org>
Date: Tue, 6 May 2025 12:22:24 +0000
Subject: [PATCH 03/14] * Use same terminology for a few things like "binary
 release" * Add reccomendation to windows part * Add sub-title before sources
 types

---
 llvm/utils/release/github-upload-release.py | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/llvm/utils/release/github-upload-release.py b/llvm/utils/release/github-upload-release.py
index 8ad3e0671ff40..423f996bc7209 100755
--- a/llvm/utils/release/github-upload-release.py
+++ b/llvm/utils/release/github-upload-release.py
@@ -51,20 +51,20 @@ def create_release(repo, release, tag=None, name=None, message=None):
 
 # Package Types
 
-* If the file name starts with `LLVM-` then it is a binary release of all of LLVM for the platform at the end of the file name. For example, `LLVM-20.1.1-Linux-ARM64.tar.xz` contains LLVM binaries for Arm64 Linux.
-* If the file name starts with `clang+llvm-` then it is a binary release for the platform at the end of the filename. For example, `clang+llvm-20.1.1-armv7a-linux-gnueabihf.tar.gz` contains LLVM binaries for Armv7-a Linux.
+* If the file name starts with `LLVM-` then it is a binary release of LLVM for the platform at the end of the file name. For example, `LLVM-20.1.1-Linux-ARM64.tar.xz` contains LLVM binaries for Arm64 Linux.
+* If the file name starts with `clang+llvm-` then it is a binary release of LLVM for the platform at the end of the filename. For example, `clang+llvm-20.1.1-armv7a-linux-gnueabihf.tar.gz` contains LLVM binaries for Armv7-a Linux.
 
-Most of the time, you will want one of the files described above.
+Most of the time, you will want one of the files described above. Each platform will have either an `LLVM-` package or a `clang+llvm-` package.
 
-Each platform will have either an `LLVM-` package or a `clang+llvm-` package. Except for Windows which has both. For Windows, the `LLVM-` file is an installer intended for using LLVM as a toolchain. The `clang+llvm-` file contains the contents of the installer, plus libraries and tools not normally used in a toolchain.
+Except for Windows which has both. For Windows, the `LLVM-` file is an installer intended for using LLVM as a toolchain. The `clang+llvm-` file contains the contents of the installer, plus libraries and tools not normally used in a toolchain. You most likely want the installer, unless you are developing software which itself uses LLVM.
 
 If you do not find a release package for your platform, you may be able to find a community built package on the LLVM Discourse forum thread for this release. Remember that these are built by volunteers and may not always be available.
 
 If you rely on a platform or configuration that is not one of the defaults, we suggest you use the binaries that your platform provides, or build your own release packages.
 
-* `<sub-project>*.src.tar.xz` are archives of the sources of specific sub-projects of `llvm-project` (aside from `test-suite` which is an archive of the [LLVM Test Suite](https://github.com/llvm/llvm-test-suite)).
-
-* To get all the `llvm-project` sources for this release, choose the one of the `Source Code`archives."""
+In addition, source archives are available:
+* `<sub-project>*.src.tar.xz` are archives of the sources of specific sub-projects of `llvm-project` (except for `test-suite` which is an archive of the [LLVM Test Suite](https://github.com/llvm/llvm-test-suite)).
+* To get all the `llvm-project` source code for this release, choose the one of the `Source Code`archives."""
         ).format(release)
 
     prerelease = True if "rc" in release else False

>From 1a0ede5829f5afb98100f40bc9c513affa24e223 Mon Sep 17 00:00:00 2001
From: David Spickett <david.spickett at linaro.org>
Date: Tue, 6 May 2025 12:33:28 +0000
Subject: [PATCH 04/14] * Use {release} number in examples so they stay up to
 date. * Reword Windows a bit.

---
 llvm/utils/release/github-upload-release.py | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/llvm/utils/release/github-upload-release.py b/llvm/utils/release/github-upload-release.py
index 423f996bc7209..13652527420b3 100755
--- a/llvm/utils/release/github-upload-release.py
+++ b/llvm/utils/release/github-upload-release.py
@@ -47,16 +47,16 @@ def create_release(repo, release, tag=None, name=None, message=None):
         # do the reflowing for us instead.
         message = dedent(
             """\
-LLVM {} Release
+LLVM {release} Release
 
 # Package Types
 
-* If the file name starts with `LLVM-` then it is a binary release of LLVM for the platform at the end of the file name. For example, `LLVM-20.1.1-Linux-ARM64.tar.xz` contains LLVM binaries for Arm64 Linux.
-* If the file name starts with `clang+llvm-` then it is a binary release of LLVM for the platform at the end of the filename. For example, `clang+llvm-20.1.1-armv7a-linux-gnueabihf.tar.gz` contains LLVM binaries for Armv7-a Linux.
+* If the file name starts with `LLVM-` then it is a binary release of LLVM for the platform at the end of the file name. For example, `LLVM-{release}-Linux-ARM64.tar.xz` contains LLVM binaries for Arm64 Linux.
+* If the file name starts with `clang+llvm-` then it is a binary release of LLVM for the platform at the end of the filename. For example, `clang+llvm-{release}-armv7a-linux-gnueabihf.tar.gz` contains LLVM binaries for Armv7-a Linux.
 
 Most of the time, you will want one of the files described above. Each platform will have either an `LLVM-` package or a `clang+llvm-` package.
 
-Except for Windows which has both. For Windows, the `LLVM-` file is an installer intended for using LLVM as a toolchain. The `clang+llvm-` file contains the contents of the installer, plus libraries and tools not normally used in a toolchain. You most likely want the installer, unless you are developing software which itself uses LLVM.
+Except for Windows. Where the `LLVM-` file is an installer intended for using LLVM as a toolchain and the `clang+llvm-` archive contains the contents of the installer, plus libraries and tools not normally used in a toolchain. You most likely want the `LLLVM-` installer, unless you are developing software which itself uses LLVM, in which case choose the `clang+llvm-` archive.
 
 If you do not find a release package for your platform, you may be able to find a community built package on the LLVM Discourse forum thread for this release. Remember that these are built by volunteers and may not always be available.
 
@@ -64,8 +64,8 @@ def create_release(repo, release, tag=None, name=None, message=None):
 
 In addition, source archives are available:
 * `<sub-project>*.src.tar.xz` are archives of the sources of specific sub-projects of `llvm-project` (except for `test-suite` which is an archive of the [LLVM Test Suite](https://github.com/llvm/llvm-test-suite)).
-* To get all the `llvm-project` source code for this release, choose the one of the `Source Code`archives."""
-        ).format(release)
+* To get all the `llvm-project` source code for this release, choose the one of the `Source Code` archives."""
+        ).format(release=release)
 
     prerelease = True if "rc" in release else False
 

>From 04b683964ab819ed2c4855d6b68fda28b0bf16fd Mon Sep 17 00:00:00 2001
From: David Spickett <david.spickett at linaro.org>
Date: Tue, 6 May 2025 13:56:45 +0000
Subject: [PATCH 05/14] * Combine the first two prefixes * Fix typos in the
 Windows section

---
 llvm/utils/release/github-upload-release.py | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/llvm/utils/release/github-upload-release.py b/llvm/utils/release/github-upload-release.py
index 13652527420b3..71fc653303657 100755
--- a/llvm/utils/release/github-upload-release.py
+++ b/llvm/utils/release/github-upload-release.py
@@ -51,12 +51,9 @@ def create_release(repo, release, tag=None, name=None, message=None):
 
 # Package Types
 
-* If the file name starts with `LLVM-` then it is a binary release of LLVM for the platform at the end of the file name. For example, `LLVM-{release}-Linux-ARM64.tar.xz` contains LLVM binaries for Arm64 Linux.
-* If the file name starts with `clang+llvm-` then it is a binary release of LLVM for the platform at the end of the filename. For example, `clang+llvm-{release}-armv7a-linux-gnueabihf.tar.gz` contains LLVM binaries for Armv7-a Linux.
+Each platform has one binary release package. The file name starts with either `LLVM-` or `clang+llvm-` and ends with the platform's name. For example, `LLVM-{release}-Linux-ARM64.tar.xz` contains LLVM binaries for Arm64 Linux.
 
-Most of the time, you will want one of the files described above. Each platform will have either an `LLVM-` package or a `clang+llvm-` package.
-
-Except for Windows. Where the `LLVM-` file is an installer intended for using LLVM as a toolchain and the `clang+llvm-` archive contains the contents of the installer, plus libraries and tools not normally used in a toolchain. You most likely want the `LLLVM-` installer, unless you are developing software which itself uses LLVM, in which case choose the `clang+llvm-` archive.
+Except for Windows. Where `LLVM-` is an installer intended for using LLVM as a toolchain and `clang+llvm-` contains the contents of the installer, plus libraries and tools not normally used in a toolchain. You most likely want the `LLVM-` installer, unless you are developing software which itself uses LLVM, in which case choose `clang+llvm-`.
 
 If you do not find a release package for your platform, you may be able to find a community built package on the LLVM Discourse forum thread for this release. Remember that these are built by volunteers and may not always be available.
 

>From 196eccfaa537352e631be06a404c8d904c6abd96 Mon Sep 17 00:00:00 2001
From: David Spickett <david.spickett at linaro.org>
Date: Tue, 6 May 2025 14:27:42 +0000
Subject: [PATCH 06/14] * Note .exe suffix on Windows installers.

---
 llvm/utils/release/github-upload-release.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/llvm/utils/release/github-upload-release.py b/llvm/utils/release/github-upload-release.py
index 71fc653303657..7c00cb45b9072 100755
--- a/llvm/utils/release/github-upload-release.py
+++ b/llvm/utils/release/github-upload-release.py
@@ -53,7 +53,7 @@ def create_release(repo, release, tag=None, name=None, message=None):
 
 Each platform has one binary release package. The file name starts with either `LLVM-` or `clang+llvm-` and ends with the platform's name. For example, `LLVM-{release}-Linux-ARM64.tar.xz` contains LLVM binaries for Arm64 Linux.
 
-Except for Windows. Where `LLVM-` is an installer intended for using LLVM as a toolchain and `clang+llvm-` contains the contents of the installer, plus libraries and tools not normally used in a toolchain. You most likely want the `LLVM-` installer, unless you are developing software which itself uses LLVM, in which case choose `clang+llvm-`.
+Except for Windows. Where `LLVM-*.exe` is an installer intended for using LLVM as a toolchain and `clang+llvm-` contains the contents of the installer, plus libraries and tools not normally used in a toolchain. You most likely want the `LLVM-` installer, unless you are developing software which itself uses LLVM, in which case choose `clang+llvm-`.
 
 If you do not find a release package for your platform, you may be able to find a community built package on the LLVM Discourse forum thread for this release. Remember that these are built by volunteers and may not always be available.
 

>From 4d4f209fdf4006b67ee9c5abf035bf8d688cac26 Mon Sep 17 00:00:00 2001
From: David Spickett <david.spickett at linaro.org>
Date: Mon, 30 Jun 2025 15:11:40 +0000
Subject: [PATCH 07/14] Use smaller title so we don't compete with the Title of
 the release itself.

---
 llvm/utils/release/github-upload-release.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/llvm/utils/release/github-upload-release.py b/llvm/utils/release/github-upload-release.py
index 7c00cb45b9072..42cb3f46df395 100755
--- a/llvm/utils/release/github-upload-release.py
+++ b/llvm/utils/release/github-upload-release.py
@@ -49,7 +49,7 @@ def create_release(repo, release, tag=None, name=None, message=None):
             """\
 LLVM {release} Release
 
-# Package Types
+## Package Types
 
 Each platform has one binary release package. The file name starts with either `LLVM-` or `clang+llvm-` and ends with the platform's name. For example, `LLVM-{release}-Linux-ARM64.tar.xz` contains LLVM binaries for Arm64 Linux.
 

>From 74d8586aeefeb041c4dd8bc3bf2f067fd1fa6dfe Mon Sep 17 00:00:00 2001
From: David Spickett <david.spickett at linaro.org>
Date: Tue, 1 Jul 2025 12:49:10 +0000
Subject: [PATCH 08/14] add gpg instructions

---
 llvm/utils/release/github-upload-release.py | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/llvm/utils/release/github-upload-release.py b/llvm/utils/release/github-upload-release.py
index 42cb3f46df395..c093508f69ede 100755
--- a/llvm/utils/release/github-upload-release.py
+++ b/llvm/utils/release/github-upload-release.py
@@ -61,7 +61,20 @@ def create_release(repo, release, tag=None, name=None, message=None):
 
 In addition, source archives are available:
 * `<sub-project>*.src.tar.xz` are archives of the sources of specific sub-projects of `llvm-project` (except for `test-suite` which is an archive of the [LLVM Test Suite](https://github.com/llvm/llvm-test-suite)).
-* To get all the `llvm-project` source code for this release, choose the one of the `Source Code` archives."""
+* To get all the `llvm-project` source code for this release, choose the one of the `Source Code` archives.
+
+## Verifying Packages
+
+All packages are signed by the release managers using GPG. To verify a package,
+first [download](https://releases.llvm.org/release-keys.asc) the keys from
+the LLVM website, then import them into your keyring:
+```
+$ gpg --import release-keys.asc
+```
+Then verify the package using the matching `.sig` file:
+```
+$ gpg --verify <package file name>.sig <package file name>
+```"""
         ).format(release=release)
 
     prerelease = True if "rc" in release else False

>From 33f1b1994c981c4c6be7dcd8cb430bb15e1601c5 Mon Sep 17 00:00:00 2001
From: David Spickett <david.spickett at linaro.org>
Date: Tue, 1 Jul 2025 12:50:03 +0000
Subject: [PATCH 09/14] unwraplines

---
 llvm/utils/release/github-upload-release.py | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/llvm/utils/release/github-upload-release.py b/llvm/utils/release/github-upload-release.py
index c093508f69ede..ff23e90174737 100755
--- a/llvm/utils/release/github-upload-release.py
+++ b/llvm/utils/release/github-upload-release.py
@@ -65,9 +65,7 @@ def create_release(repo, release, tag=None, name=None, message=None):
 
 ## Verifying Packages
 
-All packages are signed by the release managers using GPG. To verify a package,
-first [download](https://releases.llvm.org/release-keys.asc) the keys from
-the LLVM website, then import them into your keyring:
+All packages are signed by the release managers using GPG. To verify a package, first [download](https://releases.llvm.org/release-keys.asc) the keys from the LLVM website, then import them into your keyring:
 ```
 $ gpg --import release-keys.asc
 ```

>From e6b54eb812dc015e62c5a8aa4b61bb9889b03688 Mon Sep 17 00:00:00 2001
From: David Spickett <david.spickett at linaro.org>
Date: Tue, 1 Jul 2025 12:53:15 +0000
Subject: [PATCH 10/14] emmphasise verifying

---
 llvm/utils/release/github-upload-release.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/llvm/utils/release/github-upload-release.py b/llvm/utils/release/github-upload-release.py
index ff23e90174737..08be50f5642c9 100755
--- a/llvm/utils/release/github-upload-release.py
+++ b/llvm/utils/release/github-upload-release.py
@@ -65,7 +65,7 @@ def create_release(repo, release, tag=None, name=None, message=None):
 
 ## Verifying Packages
 
-All packages are signed by the release managers using GPG. To verify a package, first [download](https://releases.llvm.org/release-keys.asc) the keys from the LLVM website, then import them into your keyring:
+All packages are signed by the release managers using GPG and should be verified before use. To verify a package, first [download](https://releases.llvm.org/release-keys.asc) the keys from the LLVM website, then import them into your keyring:
 ```
 $ gpg --import release-keys.asc
 ```

>From a11344de508fe868f720a587a2e12e2f2a0841ce Mon Sep 17 00:00:00 2001
From: David Spickett <david.spickett at linaro.org>
Date: Wed, 2 Jul 2025 15:09:07 +0000
Subject: [PATCH 11/14] reccomend the llvm-project source archive that has a
 signature, instead of the github generated zip

---
 llvm/utils/release/github-upload-release.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/llvm/utils/release/github-upload-release.py b/llvm/utils/release/github-upload-release.py
index 08be50f5642c9..6728591f41e7d 100755
--- a/llvm/utils/release/github-upload-release.py
+++ b/llvm/utils/release/github-upload-release.py
@@ -61,7 +61,7 @@ def create_release(repo, release, tag=None, name=None, message=None):
 
 In addition, source archives are available:
 * `<sub-project>*.src.tar.xz` are archives of the sources of specific sub-projects of `llvm-project` (except for `test-suite` which is an archive of the [LLVM Test Suite](https://github.com/llvm/llvm-test-suite)).
-* To get all the `llvm-project` source code for this release, choose the one of the `Source Code` archives.
+* To get all the `llvm-project` source code for this release, choose `llvm-project-{release}.src.tar.xz`.
 
 ## Verifying Packages
 

>From 50ce71f8240cba15a255e0e63be610d27adbafb7 Mon Sep 17 00:00:00 2001
From: David Spickett <david.spickett at linaro.org>
Date: Thu, 3 Jul 2025 15:01:22 +0000
Subject: [PATCH 12/14] add gh/jsonl instructions

---
 llvm/utils/release/github-upload-release.py | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/llvm/utils/release/github-upload-release.py b/llvm/utils/release/github-upload-release.py
index 6728591f41e7d..68b796410f79d 100755
--- a/llvm/utils/release/github-upload-release.py
+++ b/llvm/utils/release/github-upload-release.py
@@ -65,13 +65,20 @@ def create_release(repo, release, tag=None, name=None, message=None):
 
 ## Verifying Packages
 
-All packages are signed by the release managers using GPG and should be verified before use. To verify a package, first [download](https://releases.llvm.org/release-keys.asc) the keys from the LLVM website, then import them into your keyring:
+All packages come with a matching `.sig` or `.jsonl` file. You should use these to verify the integrity of the packages.
+
+If it has a `.sig` file, it should have been signed by the release managers using GPG. Download the keys from the [LLVM website]((https://releases.llvm.org/release-keys.asc), import them into your keyring and use them to verify the file:
 ```
 $ gpg --import release-keys.asc
+$ gpg --verify <package file name>.sig <package file name>
 ```
-Then verify the package using the matching `.sig` file:
+
+If it has a `.jsonl` file, use [gh](https://cli.github.com/manual/gh_attestation_verify) to verify the package:
 ```
-$ gpg --verify <package file name>.sig <package file name>
+gh attestation verify --repo llvm/llvm-project <package file name>
+(if you are able to connect to GitHub)
+gh attestation verify --repo llvm/llvm-project <package file name> --bundle <package file name>.jsonl
+(using attestation file on disk)
 ```"""
         ).format(release=release)
 

>From 97d4d11230166855aa59129314dead0db1ab0d86 Mon Sep 17 00:00:00 2001
From: David Spickett <david.spickett at linaro.org>
Date: Thu, 3 Jul 2025 15:02:41 +0000
Subject: [PATCH 13/14] correct link

---
 llvm/utils/release/github-upload-release.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/llvm/utils/release/github-upload-release.py b/llvm/utils/release/github-upload-release.py
index 68b796410f79d..80bd2b0401c22 100755
--- a/llvm/utils/release/github-upload-release.py
+++ b/llvm/utils/release/github-upload-release.py
@@ -67,7 +67,7 @@ def create_release(repo, release, tag=None, name=None, message=None):
 
 All packages come with a matching `.sig` or `.jsonl` file. You should use these to verify the integrity of the packages.
 
-If it has a `.sig` file, it should have been signed by the release managers using GPG. Download the keys from the [LLVM website]((https://releases.llvm.org/release-keys.asc), import them into your keyring and use them to verify the file:
+If it has a `.sig` file, it should have been signed by the release managers using GPG. Download the keys from the [LLVM website](https://releases.llvm.org/release-keys.asc), import them into your keyring and use them to verify the file:
 ```
 $ gpg --import release-keys.asc
 $ gpg --verify <package file name>.sig <package file name>

>From 52e5060d749b72efc4c24d304c4f36cc6e82a165 Mon Sep 17 00:00:00 2001
From: David Spickett <david.spickett at linaro.org>
Date: Fri, 4 Jul 2025 08:01:26 +0000
Subject: [PATCH 14/14] correct source archive name

---
 llvm/utils/release/github-upload-release.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/llvm/utils/release/github-upload-release.py b/llvm/utils/release/github-upload-release.py
index 80bd2b0401c22..e9591b00e2b5a 100755
--- a/llvm/utils/release/github-upload-release.py
+++ b/llvm/utils/release/github-upload-release.py
@@ -60,7 +60,7 @@ def create_release(repo, release, tag=None, name=None, message=None):
 If you rely on a platform or configuration that is not one of the defaults, we suggest you use the binaries that your platform provides, or build your own release packages.
 
 In addition, source archives are available:
-* `<sub-project>*.src.tar.xz` are archives of the sources of specific sub-projects of `llvm-project` (except for `test-suite` which is an archive of the [LLVM Test Suite](https://github.com/llvm/llvm-test-suite)).
+* `<sub-project>-{release}.src.tar.xz` are archives of the sources of specific sub-projects of `llvm-project` (except for `test-suite` which is an archive of the [LLVM Test Suite](https://github.com/llvm/llvm-test-suite)).
 * To get all the `llvm-project` source code for this release, choose `llvm-project-{release}.src.tar.xz`.
 
 ## Verifying Packages



More information about the llvm-commits mailing list