Skip to content
This repository was archived by the owner on Dec 13, 2023. It is now read-only.

BTS-793 | Add how SHA256 hash of download can be checked #926

Merged
merged 8 commits into from
Mar 18, 2022
Merged

BTS-793 | Add how SHA256 hash of download can be checked #926

merged 8 commits into from
Mar 18, 2022

Conversation

Simran-B
Copy link
Collaborator

@Simran-B Simran-B commented Feb 24, 2022 •
edited
Loading

Initial work on adding verification instructions:

  • SHA256 check for downloads (only tested under Windows and Linux)
  • Package managers - how do they verify downloads?
  • Anything else? .asc, GPG?
@Simran-B Simran-B self-assigned this Feb 24, 2022
dothebart
dothebart reviewed Feb 25, 2022
View reviewed changes
@dothebart
Copy link
Contributor

debian / RPM => repositories and their meta data are signed, packages themselves only indirectly. Package signing has been discarded by the debian team.
@Simran-B Simran-B marked this pull request as ready for review March 1, 2022 00:05
Simran-B
Simran-B commented Mar 1, 2022
View reviewed changes
@Simran-B Simran-B mentioned this pull request Mar 3, 2022
Closed
@Simran-B
Copy link
Collaborator Author

FYI: Our .rpm files can apparently be validated using rpm --import and rpm --checksig:

$ curl -O https://download.arangodb.com/arangodb39/RPM/x86_64/arangodb3-3.9.0-1.0.x86_64.rpm $ rpm --checksig arangodb3-3.9.0-1.0.x86_64.rpm arangodb3-3.9.0-1.0.x86_64.rpm: RSA sha1 ((MD5) PGP) md5 NOT OK (MISSING KEYS: (MD5) PGP#6e751e9b) $ rpm --import https://download.arangodb.com/arangodb39/RPM/repodata/repomd.xml.key $ rpm --checksig arangodb3-3.9.0-1.0.x86_64.rpm arangodb3-3.9.0-1.0.x86_64.rpm: rsa sha1 (md5) pgp md5 OK

rpm --verify arangodb3 seems to verify the installed package files, nothing printed meaning they are all fine.
@Simran-B Simran-B requested a review from KVS85 March 14, 2022 13:49
ansoboleva
ansoboleva approved these changes Mar 15, 2022
View reviewed changes
Copy link
Collaborator

@ansoboleva ansoboleva left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Simran-B can you please apply these changes to 3.9 (the current stable version) as well? Otherwise, lgtm.
KVS85
KVS85 suggested changes Mar 15, 2022
View reviewed changes
Copy link
Collaborator

@KVS85 KVS85 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See comments.
@Simran-B Simran-B requested a review from KVS85 March 17, 2022 11:09
KVS85
KVS85 approved these changes Mar 17, 2022
View reviewed changes
Copy link
Collaborator

@KVS85 KVS85 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.
@ansoboleva ansoboleva merged commit b154364 into main Mar 18, 2022
@ansoboleva ansoboleva deleted the download-sha256 branch March 18, 2022 07:01
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

9 Ready to Merge

4 participants

@Simran-B @dothebart @KVS85 @ansoboleva