Clarify GPG verification

docker-library · Oct 7, 2021 · 3104b3a · 3104b3a
1 parent 4ede2f8
commit 3104b3a
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/README.md b/README.md
@@ -236,6 +236,7 @@ The purpose in recommending checksum verification is to verify that the artifact
 Below are some examples:
 
 -	**Preferred**: *download over https, PGP key full fingerprint import and `asc` verification, embedded checksum verified.*
+-	**Note:**: verifying the gpg signature of the hash file only is as secure as verifying the signature of the data itself and common practice (given that it's a strong hash)
 
 	```Dockerfile
 	ENV PYTHON_DOWNLOAD_SHA512 (sha512-value-here)