Skip to content

Commit 4a21ef8

Browse files
jeff-allen-mongojeff-allen-mongo
authored
DOCSP-40664-verify-signature (#686) (#692)
* WIP * DOCSP-40664-verify-package-signatures * fixes * edits * fix variable * review feedback (cherry picked from commit 5a55fdb)
1 parent 2492a86 commit 4a21ef8

File tree

9 files changed

+248
-1
lines changed

9 files changed

+248
-1
lines changed

‎snooty.toml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ intersphinx = [ "https://www.mongodb.com/docs/atlas/objects.inv",
1414

1515
toc_landing_pages = ["/quickstart",
1616
"/installation",
17+
"/installation/verify",
1718
"reference/reference",
1819
"/connecting",
1920
"/topologies",
@@ -53,4 +54,4 @@ targets = [
5354
variant = "warning"
5455
value = """\
5556
MongoDB ``mongosync`` binaries are not supported or tested for use with non-genuine MongoDB deployments. While the tools may work on these deployments, compatibility is not guaranteed.
56-
"""
57+
"""

‎source/includes/verification-gpg-results.rst

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
If the key imports successfully, the command returns:
2+
3+
.. code-block:: sh
4+
:copyable: false
5+
6+
gpg: key 3132835C1D925D5B: public key "MongoDB CLI Tools Release Signing Key <[email protected]>" imported
7+
gpg: Total number processed: 1
8+
gpg: imported: 1
9+
10+
If you have previously imported the key, the command returns:
11+
12+
.. code-block:: sh
13+
:copyable: false
14+
15+
gpg: key 3132835C1D925D5B: "MongoDB CLI Tools Release Signing Key <[email protected]>" not changed
16+
gpg: Total number processed: 1
17+
gpg: unchanged: 1

‎source/includes/verify-signatures-before-you-begin.rst

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
If you don't have ``mongosync`` installed, download the ``mongosync``
2+
package from the `Download Center
3+
<https://www.mongodb.com/try/download/relational-migrator?jmp=docs>`__.

‎source/includes/verify-signatures-intro.rst

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
The MongoDB release team digitally signs ``mongosync`` packages to
2+
certify that the packages are a valid and unaltered MongoDB release.
3+
Before you install ``mongosync``, you can use the digital signature to
4+
validate the package.

‎source/installation.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,3 +24,4 @@ These documents provide instructions to install {+c2c-full-product-name+}.
2424

2525
Linux </installation/install-on-linux>
2626
macOS </installation/install-on-macos>
27+
Verify Packages </installation/verify>

‎source/installation/verify.txt

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
.. _c2c-verify-signature:
2+
3+
======================================
4+
Verify Integrity of mongosync Packages
5+
======================================
6+
7+
.. contents:: On this page
8+
:local:
9+
:backlinks: none
10+
:depth: 1
11+
:class: singlecol
12+
13+
.. facet::
14+
:name: genre
15+
:values: tutorial
16+
17+
.. include:: /includes/verify-signatures-intro.rst
18+
19+
To learn how to verify ``mongosync`` packages, see the corresponding
20+
page for your verification method:
21+
22+
- :ref:`c2c-verify-signatures-macos`
23+
24+
- :ref:`c2c-verify-signatures-gpg`
25+
26+
- :ref:`c2c-verify-signatures-rpm`
27+
28+
.. toctree::
29+
:titlesonly:
30+
31+
macOS </installation/verify/macos>
32+
Linux </installation/verify/gpg>
33+
RHEL </installation/verify/rpm>

‎source/installation/verify/gpg.txt

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
.. _c2c-verify-signatures-gpg:
2+
3+
================================
4+
Verify Packages with GPG (Linux)
5+
================================
6+
7+
.. contents:: On this page
8+
:local:
9+
:backlinks: none
10+
:depth: 1
11+
:class: singlecol
12+
13+
.. facet::
14+
:name: genre
15+
:values: tutorial
16+
17+
.. include:: /includes/verify-signatures-intro.rst
18+
19+
This page describes how to use GPG to verify Linux packages.
20+
21+
Before you Begin
22+
----------------
23+
24+
.. include:: /includes/verify-signatures-before-you-begin.rst
25+
26+
Steps
27+
-----
28+
29+
.. procedure::
30+
:style: normal
31+
32+
.. step:: Import the MongoDB Server Tools public key
33+
34+
.. code-block:: sh
35+
36+
curl https://pgp.mongodb.com/server-Tools.asc | gpg --import
37+
38+
.. include:: /includes/verification-gpg-results.rst
39+
40+
.. step:: Download the mongosync public signature
41+
42+
To download the ``mongosync`` public signature, run the following
43+
command, replacing the placeholder values with your platform,
44+
architecture, and ``mongosync`` version:
45+
46+
.. code-block:: sh
47+
48+
curl -LO https://s3.amazonaws.com/downloads.mongodb.org/tools/mongosync/mongosync-<platform>-<architecture>-<version>.tgz.sig
49+
50+
.. example::
51+
52+
The following URL contains the signature file for ``mongosync``
53+
on Amazon Linux 2, version {+latest-version+}:
54+
55+
``https://s3.amazonaws.com/downloads.mongodb.org/tools/mongosync/mongosync-amazon2-x86_64-{+latest-version+}.tgz.sig``
56+
57+
.. step:: Verify the package
58+
59+
.. code-block:: sh
60+
61+
gpg --verify <path_to_signature_file> <path_to_mongosync_package>
62+
63+
If the package is signed by MongoDB, the command returns:
64+
65+
.. code-block:: sh
66+
:copyable: false
67+
68+
gpg: Signature made Wed 19 Feb 2025 02:19:15 PM EST
69+
gpg: using RSA key D4E45C292A5C94962F0D10E13132835C1D925D5B
70+
gpg: Good signature from "MongoDB CLI Tools Release Signing Key <[email protected]>" [unknown]
71+
72+
If the package is signed but the signing key is not added to your
73+
local ``trustdb``, the command returns:
74+
75+
.. code-block:: sh
76+
:copyable: false
77+
78+
gpg: WARNING: This key is not certified with a trusted signature!
79+
gpg: There is no indication that the signature belongs to the owner.
80+
81+
If the package is not properly signed, the command returns an
82+
error message:
83+
84+
.. code-block:: sh
85+
:copyable: false
86+
87+
gpg: Signature made Wed 19 Feb 2025 02:19:15 PM EST
88+
gpg: using RSA key D4E45C292A5C94962F0D10E13132835C1D925D5B
89+
gpg: BAD signature from "MongoDB CLI Tools Release Signing Key <[email protected]>" [unknown]

‎source/installation/verify/macos.txt

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
.. _c2c-verify-signatures-macos:
2+
3+
================================
4+
Verify mongosync Binary on macOS
5+
================================
6+
7+
.. contents:: On this page
8+
:local:
9+
:backlinks: none
10+
:depth: 1
11+
:class: singlecol
12+
13+
.. facet::
14+
:name: genre
15+
:values: tutorial
16+
17+
.. include:: /includes/verify-signatures-intro.rst
18+
19+
The ``mongosync`` ``.zip`` download for macOS is notarized. This page
20+
describes how to use ``codesign`` to verify the integrity of the
21+
unzipped ``mongosync`` binary.
22+
23+
Before you Begin
24+
----------------
25+
26+
.. include:: /includes/verify-signatures-before-you-begin.rst
27+
28+
Steps
29+
-----
30+
31+
To verify the ``mongosync`` binary, run:
32+
33+
.. code-block:: sh
34+
35+
codesign -dv --verbose=4 <path_to_binary>
36+
37+
If the binary is signed by MongoDB, the output includes the following
38+
information:
39+
40+
.. code-block:: sh
41+
:copyable: false
42+
43+
Authority=Developer ID Application: MongoDB, Inc. (4XWMY46275)
44+
Authority=Developer ID Certification Authority
45+
Authority=Apple Root CA

‎source/installation/verify/rpm.txt

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
.. _c2c-verify-signatures-rpm:
2+
3+
==========================
4+
Verify RPM Packages (RHEL)
5+
==========================
6+
7+
.. contents:: On this page
8+
:local:
9+
:backlinks: none
10+
:depth: 1
11+
:class: singlecol
12+
13+
.. facet::
14+
:name: genre
15+
:values: tutorial
16+
17+
.. include:: /includes/verify-signatures-intro.rst
18+
19+
This page describes how to verify ``.rpm`` packages on RHEL operating
20+
systems.
21+
22+
Before you Begin
23+
----------------
24+
25+
.. include:: /includes/verify-signatures-before-you-begin.rst
26+
27+
Steps
28+
-----
29+
30+
.. procedure::
31+
:style: normal
32+
33+
.. step:: Import the MongoDB Server Tools public key in gpg and rpm
34+
35+
.. code-block:: sh
36+
37+
curl https://pgp.mongodb.com/server-Tools.asc | gpg --import
38+
39+
rpm --import https://pgp.mongodb.com/server-Tools.asc
40+
41+
.. include:: /includes/verification-gpg-results.rst
42+
43+
.. step:: Verify the rpm file
44+
45+
.. code-block:: sh
46+
47+
rpm --checksig <path_to_mongosync_rpm_file>
48+
49+
If the file is signed, the command returns:
50+
51+
.. code-block:: sh
52+
:copyable: false
53+
54+
<path_to_mongosync_rpm_file> digests signatures OK

0 commit comments

Comments
 (0)