Skip to content

Commit 6d3bc10

Browse files
sarahsimperssarahsimpers
authored
(DOCSP-37760) Confirm signatures on MCLI packages (#893) (#894)
1 parent 55d1a1c commit 6d3bc10

File tree

3 files changed

+205
-0
lines changed

3 files changed

+205
-0
lines changed

‎source/install.txt

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@ You can use the {+mcli-long+} to deploy and manage MongoDB clusters in
1818
|service|, |cloud-short|, and |onprem|. For operating system and MongoDB
1919
service version requirements, see :ref:`mcli-compatibility`.
2020

21+
To verify packages before installation, see :ref:`verify-packages`.
22+
2123
Install the {+mcli+}
2224
----------------------------
2325

@@ -134,3 +136,8 @@ Next Steps
134136
- :ref:`Configure the {+mcli+} <mcli-configure>` for your environment.
135137
- :ref:`Enable autocomplete <mcli-autocomplete>` to see available
136138
commands and their syntax directly in your shell.
139+
140+
.. toctree::
141+
:titlesonly:
142+
143+
Verify Packages </verify-packages>

‎source/release-notes.txt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,9 @@ Release Notes for {+mcli-long+}
6969

7070
- Updates the ``mongocli-atlas-clusters-create`` command when
7171
you don't use the ``--watch`` flag.
72+
- :ref:`Signs the Linux binaries <verify-packages-linux>` with PGP.
73+
- :ref:`Signs the Windows binaries <verify-packages-windows>` with
74+
garasign.
7275

7376
.. _mcli_1.31.1:
7477

‎source/verify-packages.txt

Lines changed: 195 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,195 @@
1+
.. _verify-packages:
2+
3+
=========================================
4+
Verify the Integrity of {+mcli+} Packages
5+
=========================================
6+
7+
.. default-domain:: mongodb
8+
9+
.. contents:: On this page
10+
:local:
11+
:backlinks: none
12+
:depth: 1
13+
:class: singlecol
14+
15+
.. facet::
16+
:name: genre
17+
:values: tutorial
18+
19+
The {+mcli+} release team digitally signs all software packages and
20+
container images to certify that a particular package is valid and
21+
unaltered. Before you install the {+mcli+} packages for Linux or
22+
Windows you should validate the
23+
package using the provided PGP signature or SHA-256 checksum
24+
information.
25+
26+
.. _verify-packages-linux:
27+
28+
Verify Linux Packages
29+
---------------------
30+
31+
MongoDB signs each release branch with a different PGP key. The public
32+
key files for the lastest {+mcli+} release is available for
33+
download from the `key server <https://pgp.mongodb.com/>`_.
34+
35+
The following procedure verifies the {+mcli+} package against its
36+
PGP key.
37+
38+
.. procedure::
39+
:style: normal
40+
41+
.. step:: Download the {+mcli+} installation file.
42+
43+
Download the {+mcli+} binaries from the
44+
`MongoDB Download Center
45+
<https://www.mongodb.com/try/download/mongocli>`__
46+
based on your Linux environment. Click :guilabel:`Copy link` and
47+
use the URL in the following instructions.
48+
49+
For example, to download the ``{+mcli-version+}`` release
50+
for Linux through the shell, run the following command:
51+
52+
.. code-block::
53+
54+
curl -LO https://fastdl.mongodb.org/mongocli/mongocli_{+mcli-version+}_linux_x86_64.tar.gz
55+
56+
.. step:: Download the public signature file.
57+
58+
Run the following command to download the file:
59+
60+
.. code-block::
61+
62+
curl -LO https://fastdl.mongodb.org/mongocli/mongocli_{+mcli-version+}_linux_x86_64.tar.gz.sig
63+
64+
.. step:: Download and import the key file.
65+
66+
Run the following command to download and import the key file:
67+
68+
.. io-code-block::
69+
:copyable: true
70+
71+
.. input::
72+
73+
curl -LO https://pgp.mongodb.com/mongodb-cli.asc
74+
gpg --import mongodb-cli.asc
75+
76+
.. output::
77+
78+
gpg: key <key-value-short>: public key "MongoDB CLI Release Signing Key <[email protected]>" imported
79+
gpg: Total number processed: 1
80+
gpg: imported: 1
81+
82+
.. step:: Verify the {+mcli+} installation file.
83+
84+
Run the following command to verify the installation file:
85+
86+
.. io-code-block::
87+
:copyable: true
88+
89+
.. input::
90+
91+
gpg --verify mongocli_{+mcli-version+}_linux_x86_64.tar.gz.sig mongocli_{+mcli-version+}_linux_x86_64.tar.gz
92+
93+
.. output::
94+
95+
gpg: Signature made Thu Mar 14 08:25:00 2024 EDT
96+
gpg: using RSA key <key-value-long>
97+
gpg: Good signature from "MongoDB CLI Release Signing Key <[email protected]>" [unknown]
98+
99+
If the package is properly signed, but you don't currently trust
100+
the signing key, ``gpg`` also returns the following message :
101+
102+
.. code-block::
103+
104+
gpg: WARNING: This key is not certified with a trusted signature!
105+
gpg: There is no indication that the signature belongs to the owner.
106+
107+
.. _verify-packages-windows:
108+
109+
Verify Windows Packages
110+
-----------------------
111+
112+
The following procedure verifies the {+mcli+} package against its
113+
SHA-256 key.
114+
115+
.. procedure::
116+
:style: normal
117+
118+
.. step:: Download the {+mcli+} installation file.
119+
120+
Download the {+mcli+} ``.msi`` or ``.zip`` file from the
121+
`MongoDB Download Center
122+
<https://www.mongodb.com/try/download/mongocli>`__ or
123+
`Github <https://github.com/mongodb/mongodb-atlas-cli/releases>`__.
124+
125+
.. step:: Save the public signature.
126+
127+
a. Download the ``checksums.txt`` file for the
128+
release from `Github
129+
<https://github.com/mongodb/mongodb-atlas-cli/releases>`__,
130+
which contains the SHA-256 key for each file. For example, for
131+
version {+mcli-version+},
132+
download the `{+mcli-version+} checksums.txt file
133+
<https://github.com/mongodb/mongodb-atlas-cli/releases/download/mongocli%2Fv{+mcli-version+}/checksums.txt>`__.
134+
#. Open the ``checksums.txt`` file and copy the text listed to
135+
the left of the package you downloaded.
136+
For example, if you downloaded ``mongocli_{+mcli-version+}_windows_x86_64.zip``,
137+
copy the text to the left of
138+
``mongocli_{+mcli-version+}_windows_x86_64.zip``.
139+
This value is the SHA-256 key value.
140+
#. Save the SHA-256 key value in a ``.txt`` file named ``mongocli-key``
141+
in your Downloads folder.
142+
143+
.. step:: Compare the signature file to the {+mcli+} installer hash.
144+
145+
Run the Powershell command to verify the package based on the
146+
file you downloaded.
147+
148+
If you downloaded
149+
``mongocli_{+mcli-version+}_windows_x86_64.zip``,
150+
run the following command:
151+
152+
.. io-code-block::
153+
:copyable: true
154+
155+
.. input::
156+
157+
$sigHash = (Get-Content $Env:HomePath\Downloads\mongocli-key.txt | Out-String).SubString(0,64).ToUpper(); `
158+
$fileHash = (Get-FileHash $Env:HomePath\Downloads\mongocli_{+mcli-version+}_windows_x86_64.zip).Hash.Trim(); `
159+
echo $sigHash; echo $fileHash; `
160+
$sigHash -eq $fileHash
161+
162+
.. output::
163+
164+
<key-value-from-signature-file>
165+
<key-value-from-downloaded-package>
166+
True
167+
168+
If you downloaded
169+
``mongocli_{+mcli-version+}_windows_x86_64.msi``,
170+
run the following command:
171+
172+
.. io-code-block::
173+
:copyable: true
174+
175+
.. input::
176+
177+
$sigHash = (Get-Content $Env:HomePath\Downloads\mongocli-key.txt | Out-String).SubString(0,64).ToUpper(); `
178+
$fileHash = (Get-FileHash $Env:HomePath\Downloads\mongocli_{+mcli-version+}_windows_x86_64.msi).Hash.Trim(); `
179+
echo $sigHash; echo $fileHash; `
180+
$sigHash -eq $fileHash
181+
182+
.. output::
183+
184+
<key-value-from-signature-file>
185+
<key-value-from-downloaded-package>
186+
True
187+
188+
The command returns the key value from the signature file, the
189+
key value from the downloaded package, and ``True`` if the two
190+
values match.
191+
192+
If the two values match, the {+mcli+} binary is verified.
193+
194+
195+

0 commit comments

Comments
 (0)