Skip to content

Commit 5e0b72b

Browse files
jeff-allen-mongojeff-allen-mongo
authored
DOCSP-38229 Verify signatures for mongosh (#334)
* WIP * update toc * update snooty.coml * WIP * edits * edit * first draft * tweak * edit * update toc depth * review edits * restructure * remove old files * update release version * typo * add rpm instructions * update toc depth * formatting fix * fix * standardize * review feedback * fix alignment * fix alignment * add windows instructions * move rpm file * fixes * add missing ref * cleanup * edit * update toc depth * wording * add oses in title and intro * wording * fix * add mongosh to ref names * fix alignment * wording * wording * fix filenames * review feedback
1 parent 11b044f commit 5e0b72b

File tree

10 files changed

+337
-2
lines changed

10 files changed

+337
-2
lines changed

‎snooty.toml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,9 @@ title = "MongoDB Shell"
33

44
intersphinx = [ "https://www.mongodb.com/docs/manual/objects.inv" ]
55

6-
toc_landing_pages = ["/run-commands",
6+
toc_landing_pages = ["/install",
7+
"/install/verify-signatures",
8+
"/run-commands",
79
"/crud",
810
"/field-level-encryption",
911
"/write-scripts",
@@ -15,7 +17,7 @@ toc_landing_pages = ["/run-commands",
1517

1618
[constants]
1719

18-
version = "2.1.4"
20+
version = "2.2.10"
1921
mdb-version = "7.0"
2022
pgp-version = "{+mdb-version+}"
2123
atlas = "MongoDB Atlas"

‎source/includes/verification-gpg-results.rst

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
If the key imports successfully, the command returns:
2+
3+
.. code-block:: sh
4+
:copyable: false
5+
6+
gpg: key CEED0419D361CB16: public key "Mongosh Release Signing Key <[email protected]>" imported
7+
gpg: Total number processed: 1
8+
gpg: imported: 1
9+
10+
If you have previously imported the key, the command returns:
11+
12+
.. code-block:: sh
13+
:copyable: false
14+
15+
gpg: key A8130EC3F9F5F923: "Mongosh Release Signing Key <[email protected]>" not changed
16+
gpg: Total number processed: 1
17+
gpg: unchanged: 1

‎source/includes/verify-signatures-before-you-begin.rst

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
If you don't have MongoDB Shell installed, download the MongoDB Shell
2+
binary from the `Download Center
3+
<https://www.mongodb.com/try/download/shell?jmp=docs>`__.

‎source/includes/verify-signatures-intro.rst

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
The MongoDB release team digitally signs MongoDB Shell packages to
2+
certify that packages are a valid and unaltered MongoDB release. Before
3+
you install MongoDB Shell, you can use the digital signature to validate
4+
the package.

‎source/install.txt

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -206,3 +206,8 @@ Once you successfully install :binary:`mongosh`, learn how to
206206
MongoDB provides a programmatically accessible list of ``mongosh``
207207
`downloads <https://downloads.mongodb.com/compass/mongosh.json>`__ that
208208
can be accessed through your application.
209+
210+
.. toctree::
211+
:titlesonly:
212+
213+
/install/verify-signatures

‎source/install/verify-signatures.txt

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
.. _verify-signatures-mongosh:
2+
3+
==========================================
4+
Verify Integrity of MongoDB Shell Packages
5+
==========================================
6+
7+
.. contents:: On this page
8+
:local:
9+
:backlinks: none
10+
:depth: 1
11+
:class: singlecol
12+
13+
.. facet::
14+
:name: genre
15+
:values: tutorial
16+
17+
.. include:: /includes/verify-signatures-intro.rst
18+
19+
To learn how to verify MongoDB Shell packages, see the corresponding
20+
page for your verification method:
21+
22+
- :ref:`mongosh-verify-signatures-disk-image`
23+
24+
- :ref:`mongosh-verify-signatures-gpg`
25+
26+
- :ref:`mongosh-verify-signatures-rpm`
27+
28+
- :ref:`mongosh-verify-signatures-windows`
29+
30+
.. toctree::
31+
:titlesonly:
32+
33+
/install/verify-signatures/disk-images
34+
/install/verify-signatures/gpg
35+
/install/verify-signatures/rpm
36+
/install/verify-signatures/windows

‎source/install/verify-signatures/disk-images.txt

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
.. _mongosh-verify-signatures-disk-image:
2+
3+
====================================================
4+
Verify Packages with Disk Image Verification (macOS)
5+
====================================================
6+
7+
.. contents:: On this page
8+
:local:
9+
:backlinks: none
10+
:depth: 1
11+
:class: singlecol
12+
13+
.. facet::
14+
:name: genre
15+
:values: tutorial
16+
17+
.. include:: /includes/verify-signatures-intro.rst
18+
19+
This page describes how to verify ``.dmg`` packages on macOS.
20+
21+
Before you Begin
22+
----------------
23+
24+
.. include:: /includes/verify-signatures-before-you-begin.rst
25+
26+
Steps
27+
-----
28+
29+
To verify the MongoDB Shell package, run:
30+
31+
.. code-block:: sh
32+
33+
codesign -dv --verbose=4 <path_to_mongosh_executable>
34+
35+
If the package is signed by MongoDB, the output includes the following
36+
information:
37+
38+
.. code-block:: sh
39+
:copyable: false
40+
41+
Authority=Developer ID Application: MongoDB, Inc. (4XWMY46275)
42+
Authority=Developer ID Certification Authority
43+
Authority=Apple Root CA

‎source/install/verify-signatures/gpg.txt

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
.. _mongosh-verify-signatures-gpg:
2+
3+
==========================================
4+
Verify Packages with GPG (Linux and macOS)
5+
==========================================
6+
7+
.. contents:: On this page
8+
:local:
9+
:backlinks: none
10+
:depth: 1
11+
:class: singlecol
12+
13+
.. facet::
14+
:name: genre
15+
:values: tutorial
16+
17+
.. include:: /includes/verify-signatures-intro.rst
18+
19+
This page describes how to use GPG to verify Linux and macOS packages.
20+
21+
Before you Begin
22+
----------------
23+
24+
.. include:: /includes/verify-signatures-before-you-begin.rst
25+
26+
Steps
27+
-----
28+
29+
.. procedure::
30+
:style: normal
31+
32+
.. step:: Import the MongoDB Shell public key
33+
34+
.. code-block:: sh
35+
36+
curl https://pgp.mongodb.com/mongosh.asc | gpg --import
37+
38+
.. include:: /includes/verification-gpg-results.rst
39+
40+
.. step:: Download the MongoDB Shell public signature
41+
42+
To download the MongoDB Shell public signature, go to the `mongosh
43+
Releases <https://github.com/mongodb-js/mongosh/releases>`__ page
44+
on GitHub and download the corresponding ``.sig`` file for your
45+
version and variant.
46+
47+
For example, if you are running
48+
``mongodb-mongosh_{+version+}_amd64.deb``, download
49+
``mongodb-mongosh_{+version+}_amd64.deb.sig``
50+
51+
.. note::
52+
53+
Make sure that you select the correct version in the GitHub
54+
releases page when you download the signature.
55+
56+
.. step:: Verify the package
57+
58+
.. code-block:: sh
59+
60+
gpg --verify <path_to_signature_file> <path_to_mongosh_executable>
61+
62+
If the package is signed by MongoDB, the command returns:
63+
64+
.. code-block:: sh
65+
:copyable: false
66+
67+
gpg: Signature made Mon Jan 22 10:22:53 2024 CET
68+
gpg: using RSA key AB1B92FFBE0D3740425DAD16A8130EC3F9F5F923
69+
gpg: Good signature from "Mongosh Release Signing Key <[email protected]>" [unknown]
70+
71+
If the package is signed but the signing key is not added to your
72+
local ``trustdb``, the command returns:
73+
74+
.. code-block:: sh
75+
:copyable: false
76+
77+
gpg: WARNING: This key is not certified with a trusted signature!
78+
gpg: There is no indication that the signature belongs to the owner.
79+
80+
If the package is not properly signed, the command returns an
81+
error message:
82+
83+
.. code-block:: sh
84+
:copyable: false
85+
86+
gpg: Signature made Mon Jan 22 10:22:53 2024 CET
87+
gpg: using RSA key AB1B92FFBE0D3740425DAD16A8130EC3F9F5F923
88+
gpg: BAD signature from "Mongosh Release Signing Key <[email protected]>" [unknown]

‎source/install/verify-signatures/rpm.txt

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
.. _mongosh-verify-signatures-rpm:
2+
3+
==========================
4+
Verify RPM Packages (RHEL)
5+
==========================
6+
7+
.. contents:: On this page
8+
:local:
9+
:backlinks: none
10+
:depth: 1
11+
:class: singlecol
12+
13+
.. facet::
14+
:name: genre
15+
:values: tutorial
16+
17+
.. include:: /includes/verify-signatures-intro.rst
18+
19+
This page describes how to verify ``.rpm`` packages on RHEL operating
20+
systems.
21+
22+
Before you Begin
23+
----------------
24+
25+
.. include:: /includes/verify-signatures-before-you-begin.rst
26+
27+
Steps
28+
-----
29+
30+
.. procedure::
31+
:style: normal
32+
33+
.. step:: Import the MongoDB Shell public key in gpg and rpm
34+
35+
.. code-block:: sh
36+
37+
curl https://pgp.mongodb.com/mongosh.asc | gpg --import
38+
39+
rpm --import https://pgp.mongodb.com/mongosh.asc
40+
41+
.. include:: /includes/verification-gpg-results.rst
42+
43+
.. step:: Verify the rpm file
44+
45+
.. code-block:: sh
46+
47+
rpm --checksig <path_to_mongosh_rpm_file>
48+
49+
If the file is signed, the command returns:
50+
51+
.. code-block:: sh
52+
:copyable: false
53+
54+
<path_to_mongosh_rpm_file> digests signatures OK

‎source/install/verify-signatures/windows.txt

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
.. _mongosh-verify-signatures-windows:
2+
3+
=======================
4+
Verify Windows Packages
5+
=======================
6+
7+
.. contents:: On this page
8+
:local:
9+
:backlinks: none
10+
:depth: 2
11+
:class: singlecol
12+
13+
.. facet::
14+
:name: genre
15+
:values: tutorial
16+
17+
.. include:: /includes/verify-signatures-intro.rst
18+
19+
This page describes how to verify Windows ``.exe`` and ``.msi``
20+
packages.
21+
22+
Before you Begin
23+
----------------
24+
25+
.. include:: /includes/verify-signatures-before-you-begin.rst
26+
27+
Steps
28+
-----
29+
30+
To verify the MongoDB Shell package on Windows, you can use one of these
31+
methods:
32+
33+
- :ref:`mongosh-verify-signatures-windows-command-line`
34+
35+
- :ref:`mongosh-verify-signatures-windows-check-properties`
36+
37+
.. _mongosh-verify-signatures-windows-command-line:
38+
39+
Verify Packages with PowerShell
40+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
41+
42+
To verify Windows packages with PowerShell, run:
43+
44+
.. code-block:: sh
45+
46+
powershell Get-AuthenticodeSignature -FilePath <path_to_mongosh_exe_or_msi>
47+
48+
If the package is signed, the command returns:
49+
50+
.. code-block:: sh
51+
:copyable: false
52+
53+
SignerCertificate Status Path
54+
----------------- ------ ----
55+
F2D7C28591847B... Valid <path_to_mongosh_exe_or_msi>
56+
57+
.. _mongosh-verify-signatures-windows-check-properties:
58+
59+
Verify Packages by Checking Properties
60+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
61+
62+
.. procedure::
63+
:style: normal
64+
65+
.. step:: Open the properties for your MongoDB Shell package
66+
67+
.. step:: Check the package's digital signatures
68+
69+
In the properties window, open the :guilabel:`Digital Signatures`
70+
tab.
71+
72+
If the package is properly signed, the Digital Signatures show
73+
these properties:
74+
75+
.. list-table::
76+
:header-rows: 1
77+
78+
* - Name of signer
79+
- Digest algorithm
80+
- Timestamp
81+
* - MONGODB, INC.
82+
- sha256
83+
- <Timestamp>

0 commit comments

Comments
 (0)