Skip to content
This repository was archived by the owner on May 1, 2025. It is now read-only.

Commit ad30b90

Browse files
jeff-allen-mongojeff-allen-mongo
committed
DOCSP-40664-verify-package-signatures
1 parent d3daf81 commit ad30b90

File tree

9 files changed

+248
-29
lines changed

9 files changed

+248
-29
lines changed

‎snooty.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ intersphinx = [ "https://www.mongodb.com/docs/atlas/objects.inv",
1414

1515
toc_landing_pages = ["/quickstart",
1616
"/installation",
17+
"/installation/verify",
1718
"/reference",
1819
"/connecting",
1920
"/topologies",

‎source/includes/verification-gpg-results.rst‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
If the key imports successfully, the command returns:
2+
3+
.. code-block:: sh
4+
:copyable: false
5+
6+
gpg: key 3132835C1D925D5B: public key "MongoDB CLI Tools Release Signing Key <[email protected]>" imported
7+
gpg: Total number processed: 1
8+
gpg: imported: 1
9+
10+
If you have previously imported the key, the command returns:
11+
12+
.. code-block:: sh
13+
:copyable: false
14+
15+
gpg: key 3132835C1D925D5B: "MongoDB CLI Tools Release Signing Key <[email protected]>" not changed
16+
gpg: Total number processed: 1
17+
gpg: unchanged: 1

‎source/includes/verify-signatures-before-you-begin.rst‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
If you don't have ``mongosync`` installed, download the ``mongosync``
2+
package from the `Download Center
3+
<https://www.mongodb.com/try/download/relational-migrator?jmp=docs>`__.

‎source/includes/verify-signatures-intro.rst‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
The MongoDB release team digitally signs ``mongosync`` packages to
2+
certify that packages are a valid and unaltered MongoDB release. Before
3+
you install ``mongosync``, you can use the digital signature to validate
4+
the package.

‎source/installation/verify-signature.txt‎

Lines changed: 0 additions & 29 deletions
This file was deleted.

‎source/installation/verify.txt‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
.. _c2c-verify-signature:
2+
3+
======================================
4+
Verify Integrity of mongosync Packages
5+
======================================
6+
7+
.. contents:: On this page
8+
:local:
9+
:backlinks: none
10+
:depth: 1
11+
:class: singlecol
12+
13+
.. facet::
14+
:name: genre
15+
:values: tutorial
16+
17+
.. include:: /includes/verify-signatures-intro.rst
18+
19+
To learn how to verify Database Tools packages, see the corresponding
20+
page for your verification method:
21+
22+
- :ref:`c2c-verify-signatures-macos`
23+
24+
- :ref:`c2c-verify-signatures-gpg`
25+
26+
- :ref:`c2c-verify-signatures-rpm`
27+
28+
.. toctree::
29+
:titlesonly:
30+
31+
macOS </installation/verify/macos>
32+
Linux </installation/verify/gpg>
33+
RHEL </installation/verify/rpm>

‎source/installation/verify/gpg.txt‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
.. _c2c-verify-signatures-gpg:
2+
3+
================================
4+
Verify Packages with GPG (Linux)
5+
================================
6+
7+
.. contents:: On this page
8+
:local:
9+
:backlinks: none
10+
:depth: 1
11+
:class: singlecol
12+
13+
.. facet::
14+
:name: genre
15+
:values: tutorial
16+
17+
.. include:: /includes/verify-signatures-intro.rst
18+
19+
This page describes how to use GPG to verify Linux packages.
20+
21+
Before you Begin
22+
----------------
23+
24+
.. include:: /includes/verify-signatures-before-you-begin.rst
25+
26+
Steps
27+
-----
28+
29+
.. procedure::
30+
:style: normal
31+
32+
.. step:: Import the MongoDB Server Tools public key
33+
34+
.. code-block:: sh
35+
36+
curl https://pgp.mongodb.com/server-Tools.asc | gpg --import
37+
38+
.. include:: /includes/verification-gpg-results.rst
39+
40+
.. step:: Download the mongosync public signature
41+
42+
To download the ``mongosync`` public signature, run the following
43+
command, replacing the placeholder values with your platform,
44+
architecture, and ``mongosync`` version:
45+
46+
https://fastdl.mongodb.org/tools/mongosync/mongosync-amazon2-x86_64-1.12.0.tgz
47+
48+
.. code-block:: sh
49+
50+
curl -LO https://s3.amazonaws.com/downloads.mongodb.org/tools/mongosync/mongosync-<platform>-<architecture>-<version>.tgz.sig
51+
52+
.. example::
53+
54+
The following URL contains the signature file for Database
55+
Tools on Amazon Linux 2, version {+version+}:
56+
57+
``https://s3.amazonaws.com/downloads.mongodb.org/tools/mongosync/mongosync-amazon2-x86_64-{+version+}.tgz.sig``
58+
59+
.. step:: Verify the package
60+
61+
.. code-block:: sh
62+
63+
gpg --verify <path_to_signature_file> <path_to_mongosync_package>
64+
65+
If the package is signed by MongoDB, the command returns:
66+
67+
.. code-block:: sh
68+
:copyable: false
69+
70+
gpg: Signature made Wed 19 Feb 2025 02:19:15 PM EST
71+
gpg: using RSA key D4E45C292A5C94962F0D10E13132835C1D925D5B
72+
gpg: Good signature from "MongoDB CLI Tools Release Signing Key <[email protected]>" [unknown]
73+
74+
If the package is signed but the signing key is not added to your
75+
local ``trustdb``, the command returns:
76+
77+
.. code-block:: sh
78+
:copyable: false
79+
80+
gpg: WARNING: This key is not certified with a trusted signature!
81+
gpg: There is no indication that the signature belongs to the owner.
82+
83+
If the package is not properly signed, the command returns an
84+
error message:
85+
86+
.. code-block:: sh
87+
:copyable: false
88+
89+
gpg: Signature made Wed 19 Feb 2025 02:19:15 PM EST
90+
gpg: using RSA key D4E45C292A5C94962F0D10E13132835C1D925D5B
91+
gpg: BAD signature from "MongoDB CLI Tools Release Signing Key <[email protected]>" [unknown]

‎source/installation/verify/macos.txt‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
.. _c2c-verify-signatures-macos:
2+
3+
================================
4+
Verify mongosync Binary on macOS
5+
================================
6+
7+
.. contents:: On this page
8+
:local:
9+
:backlinks: none
10+
:depth: 1
11+
:class: singlecol
12+
13+
.. facet::
14+
:name: genre
15+
:values: tutorial
16+
17+
.. include:: /includes/verify-signatures-intro.rst
18+
19+
The ``mongosync`` ``.zip`` download for macOS is notarized. This page
20+
describes how to use ``codesign`` to verify the integrity of the
21+
unzipped ``mongosync`` binary.
22+
23+
Before you Begin
24+
----------------
25+
26+
.. include:: /includes/verify-signatures-before-you-begin.rst
27+
28+
Steps
29+
-----
30+
31+
To verify the ``mongosync`` binary, run:
32+
33+
.. code-block:: sh
34+
35+
codesign -dv --verbose=4 <path_to_binary>
36+
37+
If the binary is signed by MongoDB, the output includes the following
38+
information:
39+
40+
.. code-block:: sh
41+
:copyable: false
42+
43+
Authority=Developer ID Application: MongoDB, Inc. (4XWMY46275)
44+
Authority=Developer ID Certification Authority
45+
Authority=Apple Root CA

‎source/installation/verify/rpm.txt‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
.. _db-tools-verify-signatures-rpm:
2+
3+
==========================
4+
Verify RPM Packages (RHEL)
5+
==========================
6+
7+
.. contents:: On this page
8+
:local:
9+
:backlinks: none
10+
:depth: 1
11+
:class: singlecol
12+
13+
.. facet::
14+
:name: genre
15+
:values: tutorial
16+
17+
.. include:: /includes/verify-signatures-intro.rst
18+
19+
This page describes how to verify ``.rpm`` packages on RHEL operating
20+
systems.
21+
22+
Before you Begin
23+
----------------
24+
25+
.. include:: /includes/verify-signatures-before-you-begin.rst
26+
27+
Steps
28+
-----
29+
30+
.. procedure::
31+
:style: normal
32+
33+
.. step:: Import the MongoDB Server Tools public key in gpg and rpm
34+
35+
.. code-block:: sh
36+
37+
curl https://pgp.mongodb.com/server-Tools.asc | gpg --import
38+
39+
rpm --import https://pgp.mongodb.com/server-Tools.asc
40+
41+
.. include:: /includes/verification-gpg-results.rst
42+
43+
.. step:: Verify the rpm file
44+
45+
.. code-block:: sh
46+
47+
rpm --checksig <path_to_mongosync_rpm_file>
48+
49+
If the file is signed, the command returns:
50+
51+
.. code-block:: sh
52+
:copyable: false
53+
54+
<path_to_db_tools_rpm_file> digests signatures OK

0 commit comments

Comments
 (0)