Skip to content

Commit 46d6b79

Browse files
jeff-allen-mongojeff-allen-mongo
authored
(DOCSP-38230): Verify Compass signatures (#636)
* (DOCSP-38230): Verify Compass signatures * fix substitution * fix toc path * update release version * update toc depth * edits * WIP * fix * WIP GPG instructions * edit * finalize gpg page * add rpm instructions * add Windows instructions * add missing refs * cleanup * review feedback * edit * update snooty.toml
1 parent 9572116 commit 46d6b79

File tree

10 files changed

+334
-2
lines changed

10 files changed

+334
-2
lines changed

‎snooty.toml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,8 @@ intersphinx = [
99
]
1010

1111
toc_landing_pages = [
12-
"/install",
12+
"/install",
13+
"/install/verify-signatures",
1314
"/connect",
1415
"/settings",
1516
"/settings/config-file",
@@ -30,7 +31,7 @@ toc_landing_pages = [
3031

3132
[constants]
3233
download-page = "`downloads page <https://www.mongodb.com/try/download/compass>`__"
33-
current-version = "1.43.0"
34+
current-version = "1.43.3"
3435
atlas = "MongoDB Atlas"
3536
qe = "Queryable Encryption"
3637
qe-preview = "{+qe+} Public Preview"

‎source/includes/verification-gpg-results.rst

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
If the key imports successfully, the command returns:
2+
3+
.. code-block:: sh
4+
:copyable: false
5+
6+
gpg: key CEED0419D361CB16: public key "MongoDB Compass Signing Key <[email protected]>" imported
7+
gpg: Total number processed: 1
8+
gpg: imported: 1
9+
10+
If you have previously imported the key, the command returns:
11+
12+
.. code-block:: sh
13+
:copyable: false
14+
15+
gpg: key A8130EC3F9F5F923: "MongoDB Compass Signing Key <[email protected]>" not changed
16+
gpg: Total number processed: 1
17+
gpg: unchanged: 1

‎source/includes/verify-signatures-before-you-begin.rst

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
If you don't have |compass| installed, download the |compass| binary
2+
from the `Download Center
3+
<https://www.mongodb.com/try/download/compass?jmp=docs>`__.

‎source/includes/verify-signatures-intro.rst

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
The MongoDB release team digitally signs |compass| packages to certify
2+
that packages are a valid and unaltered MongoDB release. Before you
3+
install |compass|, you can use the digital signature to validate the
4+
package.

‎source/install.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -267,4 +267,5 @@ To download and install |compass|, select your operating system:
267267
:titlesonly:
268268

269269
/upgrade
270+
/install/verify-signatures
270271
/editions

‎source/install/verify-signatures.txt

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
.. _verify-signatures-compass:
2+
3+
====================================
4+
Verify Integrity of Compass Packages
5+
====================================
6+
7+
.. contents:: On this page
8+
:local:
9+
:backlinks: none
10+
:depth: 1
11+
:class: singlecol
12+
13+
.. facet::
14+
:name: genre
15+
:values: tutorial
16+
17+
.. include:: /includes/verify-signatures-intro.rst
18+
19+
To learn how to verify |compass| packages, see the corresponding page
20+
for your verification method:
21+
22+
- :ref:`compass-verify-signatures-disk-image`
23+
24+
- :ref:`compass-verify-signatures-gpg`
25+
26+
- :ref:`compass-verify-signatures-rpm`
27+
28+
- :ref:`compass-verify-signatures-windows`
29+
30+
.. toctree::
31+
:titlesonly:
32+
33+
/install/verify-signatures/disk-images
34+
/install/verify-signatures/gpg
35+
/install/verify-signatures/rpm
36+
/install/verify-signatures/windows

‎source/install/verify-signatures/disk-images.txt

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
.. _compass-verify-signatures-disk-image:
2+
3+
============================================
4+
Verify Packages with Disk Image Verification
5+
============================================
6+
7+
.. contents:: On this page
8+
:local:
9+
:backlinks: none
10+
:depth: 1
11+
:class: singlecol
12+
13+
.. facet::
14+
:name: genre
15+
:values: tutorial
16+
17+
.. include:: /includes/verify-signatures-intro.rst
18+
19+
This page describes how to verify ``.dmg`` packages on macOS.
20+
21+
Before you Begin
22+
----------------
23+
24+
.. include:: /includes/verify-signatures-before-you-begin.rst
25+
26+
Steps
27+
-----
28+
29+
To verify the |compass| package, run:
30+
31+
.. code-block:: sh
32+
33+
codesign -dv --verbose=4 <path_to_compass_executable>
34+
35+
If the package is signed by MongoDB, the output includes the following
36+
information:
37+
38+
.. code-block:: sh
39+
:copyable: false
40+
41+
Authority=Developer ID Application: MongoDB, Inc. (4XWMY46275)
42+
Authority=Developer ID Certification Authority
43+
Authority=Apple Root CA

‎source/install/verify-signatures/gpg.txt

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
.. _compass-verify-signatures-gpg:
2+
3+
========================
4+
Verify Packages with GPG
5+
========================
6+
7+
.. contents:: On this page
8+
:local:
9+
:backlinks: none
10+
:depth: 1
11+
:class: singlecol
12+
13+
.. facet::
14+
:name: genre
15+
:values: tutorial
16+
17+
.. include:: /includes/verify-signatures-intro.rst
18+
19+
This page describes how to use GPG to verify packages.
20+
21+
Before you Begin
22+
----------------
23+
24+
.. include:: /includes/verify-signatures-before-you-begin.rst
25+
26+
Steps
27+
-----
28+
29+
.. procedure::
30+
:style: normal
31+
32+
.. step:: Import the |compass| public key
33+
34+
.. code-block:: sh
35+
36+
curl https://pgp.mongodb.com/compass.asc | gpg --import
37+
38+
.. include:: /includes/verification-gpg-results.rst
39+
40+
.. step:: Download the |compass| public signature
41+
42+
To download the |compass| public signature, go to the `Compass
43+
Releases <https://github.com/mongodb-js/compass/releases>`__ page
44+
on GitHub and download the corresponding ``.sig`` file for your
45+
version and variant.
46+
47+
For example, if you downloaded the
48+
``mongodb-compass-{+current-version+}-darwin-x64.zip`` archive,
49+
download the
50+
``mongodb-compass-{+current-version+}-darwin-x64.zip.sig``
51+
signature.
52+
53+
.. note::
54+
55+
Make sure that you select the correct version in the GitHub
56+
releases page when you download the signature.
57+
58+
.. step:: Verify the package
59+
60+
.. code-block:: sh
61+
62+
gpg --verify <path_to_signature_file> <path_to_compass_archive>
63+
64+
If the package is signed by MongoDB, the command returns:
65+
66+
.. code-block:: sh
67+
:copyable: false
68+
69+
gpg: Signature made Mon Jan 22 10:22:53 2024 CET
70+
gpg: using RSA key AB1B92FFBE0D3740425DAD16A8130EC3F9F5F923
71+
gpg: Good signature from "MongoDB Compass Signing Key <[email protected]>" [unknown]
72+
73+
If the package is signed but the signing key is not added to your
74+
local ``trustdb``, the command returns:
75+
76+
.. code-block:: sh
77+
:copyable: false
78+
79+
gpg: WARNING: This key is not certified with a trusted signature!
80+
gpg: There is no indication that the signature belongs to the owner.
81+
82+
If the package is not signed properly, the command returns an
83+
error message:
84+
85+
.. code-block:: sh
86+
:copyable: false
87+
88+
gpg: Signature made Mon Jan 22 10:22:53 2024 CET
89+
gpg: using RSA key AB1B92FFBE0D3740425DAD16A8130EC3F9F5F923
90+
gpg: BAD signature from "MongoDB Compass Signing Key <[email protected]>" [unknown]

‎source/install/verify-signatures/rpm.txt

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
.. _compass-verify-signatures-rpm:
2+
3+
==========================
4+
Verify RPM Packages (RHEL)
5+
==========================
6+
7+
.. contents:: On this page
8+
:local:
9+
:backlinks: none
10+
:depth: 1
11+
:class: singlecol
12+
13+
.. facet::
14+
:name: genre
15+
:values: tutorial
16+
17+
.. include:: /includes/verify-signatures-intro.rst
18+
19+
This page describes how to verify ``.rpm`` packages on RHEL operating
20+
systems.
21+
22+
Before you Begin
23+
----------------
24+
25+
.. include:: /includes/verify-signatures-before-you-begin.rst
26+
27+
Steps
28+
-----
29+
30+
.. procedure::
31+
:style: normal
32+
33+
.. step:: Import the |compass| public key in gpg and rpm
34+
35+
.. code-block:: sh
36+
37+
curl https://pgp.mongodb.com/compass.asc | gpg --import
38+
39+
rpm --import https://pgp.mongodb.com/compass.asc
40+
41+
.. include:: /includes/verification-gpg-results.rst
42+
43+
.. step:: Verify the rpm file
44+
45+
.. code-block:: sh
46+
47+
rpm --checksig <path_to_compass_rpm_file>
48+
49+
If the file is signed, the command returns:
50+
51+
.. code-block:: sh
52+
:copyable: false
53+
54+
<path_to_compass_rpm_file> digests signatures OK

‎source/install/verify-signatures/windows.txt

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
.. _compass-verify-signatures-windows:
2+
3+
=======================
4+
Verify Windows Packages
5+
=======================
6+
7+
.. contents:: On this page
8+
:local:
9+
:backlinks: none
10+
:depth: 2
11+
:class: singlecol
12+
13+
.. facet::
14+
:name: genre
15+
:values: tutorial
16+
17+
.. include:: /includes/verify-signatures-intro.rst
18+
19+
This page describes how to verify Windows ``.exe`` and ``.msi``
20+
packages.
21+
22+
Before you Begin
23+
----------------
24+
25+
.. include:: /includes/verify-signatures-before-you-begin.rst
26+
27+
Steps
28+
-----
29+
30+
To verify the |compass| package on Windows, you can use one of these
31+
methods:
32+
33+
- :ref:`compass-verify-signatures-windows-command-line`
34+
35+
- :ref:`compass-verify-signatures-windows-check-properties`
36+
37+
.. _compass-verify-signatures-windows-command-line:
38+
39+
Verify Packages with PowerShell
40+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
41+
42+
To verify Windows packages with PowerShell, run:
43+
44+
.. code-block:: sh
45+
46+
powershell Get-AuthenticodeSignature -FilePath <path_to_compass_exe_or_msi>
47+
48+
If the file is signed, the command returns:
49+
50+
.. code-block:: sh
51+
:copyable: false
52+
53+
SignerCertificate Status Path
54+
----------------- ------ ----
55+
F2D7C28591847B... Valid <path_to_compass_exe_or_msi>
56+
57+
.. _compass-verify-signatures-windows-check-properties:
58+
59+
Verify Packages by Checking Properties
60+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
61+
62+
.. procedure::
63+
:style: normal
64+
65+
.. step:: Open the properties for your |compass| package
66+
67+
.. step:: Check the package's digital signatures
68+
69+
In the properties window, open the :guilabel:`Digital Signatures`
70+
tab.
71+
72+
If the package is properly signed, the Digital Signatures show
73+
these properties:
74+
75+
.. list-table::
76+
:header-rows: 1
77+
78+
* - Name of signer
79+
- Digest algorithm
80+
- Timestamp
81+
* - MONGODB, INC.
82+
- sha256
83+
- <Timestamp>

0 commit comments

Comments
 (0)