Getting started docs: https, and check signature

[jfb]

Summary

Download should be over https, not insecure ftp at least for the signature and key files. The signature should also get verified.

[chandlerc]

I mean, this looks good.

But why ask me to review only to commit without waiting? =[ If this were code, I'd be rather annoyed as you know better. As it's just documentation, I'm just a bit annoyed because I pulled up the page to write "LGTM" without any purpose.

[jyasskin]

llvm/trunk/docs/GettingStarted.rst

331

There's not much point fetching the signing key over exactly the same transport as the data. If someone's compromised ftp.gnu.org, they can replace the key at the same time as they replace the signature. Either trust just HTTPS or fetch the signing key from somewhere else.

llvm/trunk/docs/GettingStarted.rst

.. _toolchain testing PPA:
   https://launchpad.net/~ubuntu-toolchain-r/+archive/test
 .. _ask ubuntu stack exchange:
   http://askubuntu.com/questions/271388/how-to-install-gcc-4-8-in-ubuntu-12-04-from-the-terminal
 
 Easy steps for installing GCC 4.8.2:
 
 .. code-block:: console
 
-  % wget ftp://ftp.gnu.org/gnu/gcc/gcc-4.8.2/gcc-4.8.2.tar.bz2
+  % wget https://ftp.gnu.org/gnu/gcc/gcc-4.8.2/gcc-4.8.2.tar.bz2
+  % wget https://ftp.gnu.org/gnu/gcc/gcc-4.8.2/gcc-4.8.2.tar.bz2.sig
+  % wget https://ftp.gnu.org/gnu/gnu-keyring.gpg
+  % signature_invalid=`gpg --verify --no-default-keyring --keyring ./gnu-keyring.gpg gcc-4.8.2.tar.bz2.sig`
+  % if [ $signature_invalid ]; then echo "Invalid signature" ; exit 1 ; fi
   % tar -xvjf gcc-4.8.2.tar.bz2
   % cd gcc-4.8.2
   % ./contrib/download_prerequisites
   % cd ..
   % mkdir gcc-4.8.2-build
   % cd gcc-4.8.2-build
   % $PWD/../gcc-4.8.2/configure --prefix=$HOME/toolchains --enable-languages=c,c++
   % make -j$(nproc)