@@ -306,30 +306,13 @@ describes its purpose and role within the larger system.
306306<a name =" vauth " ></a >
307307## Verifying Code Authenticity
308308
309- If you obtained an SQLite source tree from a secondary source, such as a
310- GitHub mirror, and you want to verify that it has not been altered, there
311- are a couple of ways to do that.
312-
313- If you have a release version of SQLite, and you are using the
314- ` sqlite3.c ` amalgamation, then SHA3-256 hashes for the amalgamation are
315- available in the [ change log] ( https://www.sqlite.org/changes.html ) on
316- the official website. After building the ` sqlite3.c ` file, you can check
317- that it is authentic by comparing the hash. This does not ensure that the
318- test scripts are unaltered, but it does validate the deliverable part of
319- the code and the verification process only involves computing and
320- comparing a single hash.
321-
322- For versions other than an official release, or if you are building the
323- ` sqlite3.c ` amalgamation using non-standard build options, the verification
324- process is a little more involved. The ` manifest ` file at the root directory
325- of the source tree
309+ The ` manifest ` file at the root directory of the source tree
326310contains either a SHA3-256 hash (for newer files) or a SHA1 hash (for
327- older files) for every source file in the repository. You can write a script
328- to extracts hashes from ` manifest ` and verifies the hashes against the
329- corresponding files in the source tree. The SHA3-256 hash of the ` manifest `
311+ older files) for every source file in the repository.
312+ The SHA3-256 hash of the ` manifest `
330313file itself is the official name of the version of the source tree that you
331- have. The ` manifest.uuid ` file should contain the SHA3-256 hash of the
332- ` manifest ` file. If all of the above hash comparisons are correct, then
314+ have. The ` manifest.uuid ` file should contain the SHA3-256 hash of the
315+ ` manifest ` file. If all of the above hash comparisons are correct, then
333316you can be confident that your source tree is authentic and unadulterated.
334317
335318The format of the ` manifest ` file should be mostly self-explanatory, but
0 commit comments