Difference between revisions of "Package signatures"
(Added links to openvz public key to →Public and private keys) |
(Enlarged the RPM description, fixed headings.) |
||
| Line 17: | Line 17: | ||
== Checking RPM packages == | == Checking RPM packages == | ||
| − | In order to check OpenVZ RPM package signatures, you need to import OpenVZ public key to your RPM database. To that effect, do the following: | + | RPM package manager has a build-in GPG signatures support. Signatures are embedded into the .rpm files, and public keys are stored in an rpm database In order to check OpenVZ RPM package signatures, you need to import OpenVZ public key to your RPM database. To that effect, do the following (usually you are required to be root): |
<pre> | <pre> | ||
# rpm --import RPM-GPG-Key-OpenVZ | # rpm --import RPM-GPG-Key-OpenVZ | ||
</pre> | </pre> | ||
| − | Then, to check the packages, use this command: | + | Then, to check the packages, use this command (root is not needed): |
<pre> | <pre> | ||
$ rpm -K *.rpm | $ rpm -K *.rpm | ||
| Line 31: | Line 31: | ||
Some files (e.g. precreated OS templates) are also signed by the GPG key. Unlike RPMS, they do not contain the signature inside the file, but rather there is a separate small <tt>.asc</tt> file available. | Some files (e.g. precreated OS templates) are also signed by the GPG key. Unlike RPMS, they do not contain the signature inside the file, but rather there is a separate small <tt>.asc</tt> file available. | ||
| − | == Importing the public key == | + | === Importing the public key === |
First, you need to import OpenVZ public key to your GnuPG keychain. You can either import a local file, or search for the key on one of the public keyservers. | First, you need to import OpenVZ public key to your GnuPG keychain. You can either import a local file, or search for the key on one of the public keyservers. | ||
| Line 60: | Line 60: | ||
</pre> | </pre> | ||
| − | == Checking the signature == | + | === Checking the signature === |
To check the signature, you need to have both the main file (e.g. the template tarball) and the signature file (the one which ends in <tt>.asc</tt>. Assuming you want to check the signature of <tt>centos-4-i386-default.tar.gz</tt> file: | To check the signature, you need to have both the main file (e.g. the template tarball) and the signature file (the one which ends in <tt>.asc</tt>. Assuming you want to check the signature of <tt>centos-4-i386-default.tar.gz</tt> file: | ||
Revision as of 10:23, 13 June 2006
All the packages that are released by OpenVZ project are digitally signed by OpenVZ GPG key. Thus, you can check that those packages are indeed came from OpenVZ.
Contents
Public and private keys
There is a pair of keys generated for the purpose of signing and verifying the signature.
Private key is the key that is available to OpenVZ stuff only and is protected by the passphrase. This key is used for signing the packages, so nobody else but OpenVZ stuff can sign them using this key.
Public key is the key that is available to everyone and can be obtained from a number of places (e.g. MIT keyserver — search for OpenVZ). Public key is used to verify the signature.
OpenVZ public key
OpenVZ public key is available from the several sources. We urge you to use a few different sources because chances are lower they all can be compromised at the same time.
- RPM-GPG-Key-OpenVZ Main site
- RPM-GPG-Key-OpenVZ Download site
- RPM-GPG-Key-OpenVZ keyserv.nic-se.se
- RPM-GPG-Key-OpenVZ pgp.mit.edu
Checking RPM packages
RPM package manager has a build-in GPG signatures support. Signatures are embedded into the .rpm files, and public keys are stored in an rpm database In order to check OpenVZ RPM package signatures, you need to import OpenVZ public key to your RPM database. To that effect, do the following (usually you are required to be root):
# rpm --import RPM-GPG-Key-OpenVZ
Then, to check the packages, use this command (root is not needed):
$ rpm -K *.rpm
Here *.rpm are some RPM packages.
Checking files
Some files (e.g. precreated OS templates) are also signed by the GPG key. Unlike RPMS, they do not contain the signature inside the file, but rather there is a separate small .asc file available.
Importing the public key
First, you need to import OpenVZ public key to your GnuPG keychain. You can either import a local file, or search for the key on one of the public keyservers.
Local file:
$ gpg --import RPM-GPG-Key-OpenVZ
From the default keyserver:
[kir@kir ~]$ gpg --search-keys OpenVZ
gpg: searching for "OpenVZ" from hkp server subkeys.pgp.net
(1) OpenVZ Project <security@openvz.org>
1024 bit DSA key A7A1D4B6, created: 2005-09-14
Keys 1-1 of 1 for "OpenVZ". Enter number(s), N)ext, or Q)uit > 1
gpg: requesting key A7A1D4B6 from hkp server subkeys.pgp.net
...
From the pgp.mit.edu keyserver:
$ gpg --keyserver pgp.mit.edu --search-keys OpenVZ
gpg: searching for "OpenVZ" from hkp server pgp.mit.edu
(1) OpenVZ Project <security@openvz.org>
1024 bit DSA key A7A1D4B6, created: 2005-09-14
Enter number(s), N)ext, or Q)uit > 1
gpg: requesting key A7A1D4B6 from hkp server pgp.mit.edu
Checking the signature
To check the signature, you need to have both the main file (e.g. the template tarball) and the signature file (the one which ends in .asc. Assuming you want to check the signature of centos-4-i386-default.tar.gz file:
$ gpg --verify centos-4-i386-default.tar.gz.asc
You should see something like this:
gpg: Signature made Wed Dec 14 19:13:53 2005 MSK using DSA key ID A7A1D4B6 gpg: Good signature from "OpenVZ Project <security@openvz.org>"
