@@ -437,30 +437,13 @@ describes its purpose and role within the larger system.
437437<a name =" vauth " ></a >
438438## Verifying Code Authenticity
439439
440- If you obtained an SQLite source tree from a secondary source, such as a
441- GitHub mirror, and you want to verify that it has not been altered, there
442- are a couple of ways to do that.
443-
444- If you have a release version of SQLite, and you are using the
445- ` sqlite3.c ` amalgamation, then SHA3-256 hashes for the amalgamation are
446- available in the [ change log] ( https://www.sqlite.org/changes.html ) on
447- the official website. After building the ` sqlite3.c ` file, you can check
448- that it is authentic by comparing the hash. This does not ensure that the
449- test scripts are unaltered, but it does validate the deliverable part of
450- the code and the verification process only involves computing and
451- comparing a single hash.
452-
453- For versions other than an official release, or if you are building the
454- ` sqlite3.c ` amalgamation using non-standard build options, the verification
455- process is a little more involved. The ` manifest ` file at the root directory
456- of the source tree
440+ The ` manifest ` file at the root directory of the source tree
457441contains either a SHA3-256 hash (for newer files) or a SHA1 hash (for
458- older files) for every source file in the repository. You can write a script
459- to extracts hashes from ` manifest ` and verifies the hashes against the
460- corresponding files in the source tree. The SHA3-256 hash of the ` manifest `
442+ older files) for every source file in the repository.
443+ The SHA3-256 hash of the ` manifest `
461444file itself is the official name of the version of the source tree that you
462- have. The ` manifest.uuid ` file should contain the SHA3-256 hash of the
463- ` manifest ` file. If all of the above hash comparisons are correct, then
445+ have. The ` manifest.uuid ` file should contain the SHA3-256 hash of the
446+ ` manifest ` file. If all of the above hash comparisons are correct, then
464447you can be confident that your source tree is authentic and unadulterated.
465448
466449The format of the ` manifest ` file should be mostly self-explanatory, but
0 commit comments