-
Notifications
You must be signed in to change notification settings - Fork 47
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #7215 from OpenLiberty/staging
Staging to vNExt 24001 backports
- Loading branch information
Showing
4 changed files
with
53 additions
and
40 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -15,21 +15,21 @@ | |
|
|
||
| You can use signature files and the corresponding public key to verify the authenticity and integrity of an Open Liberty release package. Signature files are produced for every package of an Open Liberty release. | ||
|
|
||
| Signature files are available for every Open Liberty release. The Open Liberty project uses its private key to digitally sign each Open Liberty release. You can use the Open Liberty public key to check the signature, verify that the package was released by Open Liberty, and that it was not modified since its release. | ||
| The Open Liberty project uses its private key to digitally sign each Open Liberty release. You can use the Open Liberty public key to check the signature, verify that the package was released by Open Liberty, and that it was not modified since its release. | ||
|
|
||
| You can verify a release package either locally, by using the `openssl` command and a `*.sig` file, or on Maven Central, by using the `gpg` command. When you verify the release locally, you can also verify the authenticity of the Open Liberty public key by using a certificate (`.cer`) file. | ||
| You can verify a release package either locally, by using the `openssl` command and a `.sig` file, or on Maven Central, by using the `gpg` command. When you verify the release locally, you can also verify the authenticity of the Open Liberty public key by using a certificate (`.cer`) file. | ||
|
|
||
| == Verifying Open Liberty release package signatures with OpenSSL | ||
|
|
||
| To verify an Open Liberty release package locally, you must first download an Open Liberty `.zip` package, the corresponding `*.sig` file, and the Open Liberty public key, which is included in the certificate (`.cer`) file. You can then run the `openssl` command to verify the package signature. Optionally, you can verify the authenticity of the Open Liberty public key before you verify the release package. | ||
| To verify an Open Liberty release package locally, you must first download an Open Liberty `.zip` release package, the corresponding `.sig` file, and a `.cer` file, which includes the Open Liberty public key. After you extract the Open Liberty public key from the `.cer` file, you can run the `openssl` command to verify the package signature. Optionally, you can verify the authenticity of the Open Liberty public key before you extract it from the `.cer` file. | ||
|
|
||
| In the following examples, replace the `<OpenLiberty_certificate>` and `<Open_Liberty_release_package>` variables with the public key (`.cer`), signature (`.sig`), and release package (`.zip`) files that you are using to verify a release package. | ||
|
|
||
| 1. Go to the **Download package** section of the Open Liberty https://www.openliberty.io/start/[Get Started page] and download an Open Liberty `.zip` package and the corresponding `.sig` and `.cer` files. | ||
| 1. Go to the **Download package** section of the Open Liberty https://www.openliberty.io/start/[Get Started page] and download an Open Liberty `.zip` release package and the corresponding `.sig` and `.cer` files. | ||
|
|
||
| 2. Verify the authenticity of the Open Liberty public key. | ||
| + | ||
| The Open Liberty public key is embedded in the certificate file. Before you extract the Open Liberty public key, you can verify that it was produced by Open Liberty. Run the following https://www.openssl.org/docs/man1.1.1/man1/openssl-dgst.html[openssl command] from the directory that contains the certificate file. | ||
| The Open Liberty public key is embedded in the `.cer` file. Before you extract the Open Liberty public key, you can verify that it was produced by Open Liberty. Run the following https://www.openssl.org/docs/man1.1.1/man1/openssl-dgst.html[openssl command] from the directory that contains the `.cer` file: | ||
| + | ||
| [source,sh] | ||
| ---- | ||
|
|
@@ -62,7 +62,7 @@ Certificate: | |
|
|
||
| 3. Extract the public key from the `.cer` file as a `.pem` file. | ||
| + | ||
| The Open Liberty public key is embedded in the `.cer` file. To extract the key to a separate `.pem` file, run the following command from the directory that contains the certificate file. | ||
| The Open Liberty public key is embedded in the `.cer` file. To extract the key to a separate `.pem` file, run the following command from the directory that contains the `.cer` file: | ||
| + | ||
| [source,sh] | ||
| ---- | ||
|
|
@@ -81,7 +81,7 @@ openssl dgst -sha256 -verify <OpenLiberty_certificate>.pem -signature <Open_Libe | |
| ---- | ||
|
|
||
| === Results | ||
| If the verification is successful, the command produces the following console output. | ||
| If the verification succeeds, the command produces the following console output. | ||
|
|
||
| [source,sh] | ||
| ---- | ||
|
|
@@ -90,23 +90,27 @@ Verified OK | |
|
|
||
| == Verify Open Liberty package signatures on Maven Central | ||
|
|
||
| To verify Open Liberty packages on Maven Central, you must first download the Open Liberty public key to your local machine by using https://gnupg.org[the gpg or gpg2 command]. | ||
| You must edit the trust level for the key owner. You can then use this key to remotely verify an Open Liberty `.asc` release file on Maven Central. | ||
| To verify Open Liberty packages on Maven Central, you must download `openliberty-runtime-\*.zip` and `openliberty-runtime-*.zip.asc` files for your chosen release from Maven Central. You must also download the Open Liberty public key to your local machine and set trust level for the key owner by using https://gnupg.org[the gpg or gpg2 command]. You can then use this key to verify the Open Liberty release package signature. | ||
|
|
||
| 1. Run the following command to download the Open Liberty public key file. The key ID value for the Open Liberty public key is `9E68CA00`. | ||
| 1. Go to the link:https://repo1.maven.org/maven2/io/openliberty/openliberty-runtime[openliberty-runtime repository on Maven Central] and click the release version that you want to verify, for example, `24.0.0.1`. | ||
|
|
||
| 2. Download the `openliberty-runtime-\*.zip` and `openliberty-runtime-*.zip.asc` files that correspond to the release you want to verify, for example `openliberty-runtime-24.0.0.1.zip` and `openliberty-runtime-24.0.0.1.zip.asc`. Make sure to save the `.asc` file from your browser as an `.asc` file. | ||
|
|
||
| 3. Run the following command to download the Open Liberty public key file. The key ID value for the Open Liberty public key is `9E68CA00`. | ||
| + | ||
| [source,sh] | ||
| ---- | ||
| gpg2 --keyserver hkp://keyserver.ubuntu.com --recv-keys 9E68CA00 | ||
| ---- | ||
|
|
||
| 2. Use the `gpg2 --edit-key` command to https://www.gnupg.org/gph/en/manual/x334.html[set the trust for the key owner] to 5. | ||
| 4. Run the `gpg2 --edit-key` command to https://www.gnupg.org/gph/en/manual/x334.html[set the trust for the key owner] to 5. | ||
| + | ||
| The following examples show the `gpg2 --edit-key` command and the console output that it generates. | ||
| + | ||
| [source,sh] | ||
| ---- | ||
| [root]$ gpg2 --edit-key "International Business Machines Corporation [email protected]" | ||
| gpg2 --edit-key "International Business Machines Corporation <[email protected]>" | ||
| gpg (GnuPG) 2.2.20; Copyright (C) 2020 Free Software Foundation, Inc. | ||
| This is free software: you are free to change and redistribute it. | ||
| There is NO WARRANTY, to the extent permitted by law. | ||
|
|
@@ -147,21 +151,27 @@ Your decision? 5 | |
| Do you really want to set this key to ultimate trust? (y/N) y | ||
| ---- | ||
|
|
||
| 3. Verify the file by running the `gpg2 --verify` command. The following example verifies the Open Liberty 23.0.0.2 release package. | ||
| 5. Verify the release package by running the `gpg2 --verify` command from the directory that contains the Open Liberty public key and the `.zip` and `.asc` release package files that you downloaded from Maven central. | ||
| + | ||
| The following example uses the `openliberty-runtime-24.0.0.1.zip.asc` file to verify the 24.0.0.1 release package signature. Replace this value with the release package that you want to validate. | ||
| + | ||
| [source,sh] | ||
| ---- | ||
| gpg2 --verify openliberty-runtime-23.0.0.2.zip.asc | ||
| gpg2 --verify openliberty-runtime-24.0.0.1.zip.asc | ||
| ---- | ||
|
|
||
| === Results | ||
|
|
||
| If the verification is successful, the command produces console output that is similar to the following example. | ||
| If the verification succeeds, the command produces console output that is similar to the following example: | ||
|
|
||
| [source,sh] | ||
| ---- | ||
| gpg: assuming signed data in 'openliberty-runtime-23.0.0.2.zip' | ||
| gpg: Signature made Thu 02 Mar 2023 09:02:22 AM PST | ||
| gpg: assuming signed data in 'openliberty-runtime-24.0.0.1.zip' | ||
| gpg: Signature made Thu Jan 25 08:18:11 2024 EST | ||
| gpg: using RSA key E70E5D6C3F1E452CB0F67DF1BD9FD5BE9E68CA00 | ||
| gpg: checking the trustdb | ||
| gpg: marginals needed: 3 completes needed: 1 trust model: pgp | ||
| gpg: depth: 0 valid: 2 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 2u | ||
| gpg: next trustdb check due at 2027-02-09 | ||
| gpg: Good signature from "International Business Machines Corporation <[email protected]>" [ultimate] | ||
| ---- | ||