SQLite

Check-in [adebffc18e]
Login

Many hyperlinks are disabled.
Use anonymous login to enable hyperlinks.

Overview
Comment:Simplify the "Verifying Code Authenticity" section of the README.md file. No code changes.
Downloads: Tarball | ZIP archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA3-256: adebffc18e6165672947a6bda5ca23ea7723cca7ab8da4feb81fca8f83e4fcaf
User & Date: drh 2019-05-15 10:16:34.190
Context
2019-05-15
18:42
Fix the count-of-view optimization so that it is (correctly) disabled for a query that includes a WHERE clause or a GROUP BY clause. (check-in: 05897ca48a user: drh tags: trunk)
10:16
Simplify the "Verifying Code Authenticity" section of the README.md file. No code changes. (check-in: adebffc18e user: drh tags: trunk)
2019-05-14
20:25
Fix a problem with the fix for [9cf6c9bb51] (commit [658b84d7]) that could cause a cursor to be left in an invalid state following a (rowid < text-value) search. (check-in: bc7d2c1656 user: dan tags: trunk)
Changes
Unified Diff Show Whitespace Changes Patch
Changes to README.md.
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336

There are many other source files.  Each has a succinct header comment that
describes its purpose and role within the larger system.

<a name="vauth"></a>
## Verifying Code Authenticity

If you obtained an SQLite source tree from a secondary source, such as a
GitHub mirror, and you want to verify that it has not been altered, there
are a couple of ways to do that.

If you have a release version of SQLite, and you are using the
`sqlite3.c` amalgamation, then SHA3-256 hashes for the amalgamation are
available in the [change log](https://www.sqlite.org/changes.html) on
the official website.  After building the `sqlite3.c` file, you can check
that it is authentic by comparing the hash.  This does not ensure that the
test scripts are unaltered, but it does validate the deliverable part of
the code and the verification process only involves computing and
comparing a single hash.

For versions other than an official release, or if you are building the
`sqlite3.c` amalgamation using non-standard build options, the verification
process is a little more involved.  The `manifest` file at the root directory
of the source tree
contains either a SHA3-256 hash (for newer files) or a SHA1 hash (for 
older files) for every source file in the repository.  You can write a script
to extracts hashes from `manifest` and verifies the hashes against the 
corresponding files in the source tree.  The SHA3-256 hash of the `manifest`
file itself is the official name of the version of the source tree that you
have.  The `manifest.uuid` file should contain the SHA3-256 hash of the
`manifest` file.  If all of the above hash comparisons are correct, then
you can be confident that your source tree is authentic and unadulterated.

The format of the `manifest` file should be mostly self-explanatory, but
if you want details, they are available







<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
|
<

|
<
|







302
303
304
305
306
307
308















309

310
311

312
313
314
315
316
317
318
319

There are many other source files.  Each has a succinct header comment that
describes its purpose and role within the larger system.

<a name="vauth"></a>
## Verifying Code Authenticity
















The `manifest` file at the root directory of the source tree

contains either a SHA3-256 hash (for newer files) or a SHA1 hash (for 
older files) for every source file in the repository.

The SHA3-256 hash of the `manifest`
file itself is the official name of the version of the source tree that you
have.  The `manifest.uuid` file should contain the SHA3-256 hash of the
`manifest` file.  If all of the above hash comparisons are correct, then
you can be confident that your source tree is authentic and unadulterated.

The format of the `manifest` file should be mostly self-explanatory, but
if you want details, they are available