clearlinux/clear-linux-documentation
2
0
Fork 0
mirror of https://github.com/clearlinux/clear-linux-documentation.git synced 2026-08-26 02:18:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #335 from gtkramer/signature-openssl11

Browse Source 
Add OpenSSL 1.1 support for image validation
This commit is contained in:
michael vincerra
2018-12-04 15:29:51 -08:00
committed by GitHub
parent 2d5c6e76ee bf77a1a391
commit 41fc8d41a0
1 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
source/clear-linux/guides/maintenance/validate-signatures.rst
+16 -2
View File
@@ -57,7 +57,14 @@ used for illustrative purposes. You may use any image of |CL| you choose.
.. code-block:: console
openssl smime -verify -in clear-$(curl https://download.clearlinux.org/latest)-installer.img.xz-SHA512SUMS.sig -inform der -content sha512sum.out -CAfile ClearLinuxRoot.pem
openssl smime -verify -purpose any -in clear-$(curl https://download.clearlinux.org/latest)-installer.img.xz-SHA512SUMS.sig -inform der -content sha512sum.out -CAfile ClearLinuxRoot.pem
.. note::
The `-purpose any` option is required when using OpenSSL 1.1. If using
an earlier version of OpenSSL, omit this option to perform signature
validation. The `openssl version` command may be used to determine the
version of OpenSSL in use.
#. The output should contain ``Verification successful``. If the output
contains ``bad_signature`` anywhere, then the image is not trustworthy.
@@ -101,7 +108,14 @@ these steps manually when performing a ``swupd update``.
.. code-block:: console
openssl smime -verify -in Manifest.MoM.sig -inform der -content Manifest.MoM -CAfile Swupd_Root.pem
openssl smime -verify -purpose any -in Manifest.MoM.sig -inform der -content Manifest.MoM -CAfile Swupd_Root.pem
.. note::
The `-purpose any` option is required when using OpenSSL 1.1. If using
an earlier version of OpenSSL, omit this option to perform signature
validation. The `openssl version` command may be used to determine the
version of OpenSSL in use.
.. note::