github.com/rclone/rclone@v1.66.1-0.20240517100346-7b89735ae726/docs/content/release_signing.md (about)

     1  ---
     2  title: "Release Signing"
     3  description: "How the release is signed and how to check the signature."
     4  ---
     5  
     6  # Release signing
     7  
     8  The hashes of the binary artefacts of the rclone release are signed
     9  with a public PGP/GPG key. This can be verified manually as described
    10  below.
    11  
    12  The same mechanism is also used by [rclone selfupdate](/commands/rclone_selfupdate/)
    13  to verify that the release has not been tampered with before the new
    14  update is installed. This checks the SHA256 hash and the signature
    15  with a public key compiled into the rclone binary.
    16  
    17  ## Release signing key
    18  
    19  You may obtain the release signing key from:
    20  
    21  - From [KEYS](/KEYS) on this website - this file contains all past signing keys also.
    22  - The git repository hosted on GitHub - https://github.com/rclone/rclone/blob/master/docs/content/KEYS
    23  - `gpg --keyserver hkps://keys.openpgp.org --search nick@craig-wood.com`
    24  - `gpg --keyserver hkps://keyserver.ubuntu.com --search nick@craig-wood.com`
    25  - https://www.craig-wood.com/nick/pub/pgp-key.txt
    26  
    27  After importing the key, verify that the fingerprint of one of the
    28  keys matches: `FBF737ECE9F8AB18604BD2AC93935E02FF3B54FA` as this key is used for signing.
    29  
    30  We recommend that you cross-check the fingerprint shown above through
    31  the domains listed below. By cross-checking the integrity of the
    32  fingerprint across multiple domains you can be confident that you
    33  obtained the correct key.
    34  
    35  - The [source for this page on GitHub](https://github.com/rclone/rclone/blob/master/docs/content/release_signing.md).
    36  - Through DNS `dig key.rclone.org txt`
    37  
    38  If you find anything that doesn't not match, please contact the
    39  developers at once.
    40  
    41  ## How to verify the release
    42  
    43  In the release directory you will see the release files and some files called `MD5SUMS`, `SHA1SUMS` and `SHA256SUMS`.
    44  
    45  ```
    46  $ rclone lsf --http-url https://downloads.rclone.org/v1.63.1 :http:
    47  MD5SUMS
    48  SHA1SUMS
    49  SHA256SUMS
    50  rclone-v1.63.1-freebsd-386.zip
    51  rclone-v1.63.1-freebsd-amd64.zip
    52  ...
    53  rclone-v1.63.1-windows-arm64.zip
    54  rclone-v1.63.1.tar.gz
    55  version.txt
    56  ```
    57  
    58  The `MD5SUMS`, `SHA1SUMS` and `SHA256SUMS` contain hashes of the
    59  binary files in the release directory along with a signature.
    60  
    61  For example:
    62  
    63  ```
    64  $ rclone cat --http-url https://downloads.rclone.org/v1.63.1 :http:SHA256SUMS
    65  -----BEGIN PGP SIGNED MESSAGE-----
    66  Hash: SHA1
    67  
    68  f6d1b2d7477475ce681bdce8cb56f7870f174cb6b2a9ac5d7b3764296ea4a113  rclone-v1.63.1-freebsd-386.zip
    69  7266febec1f01a25d6575de51c44ddf749071a4950a6384e4164954dff7ac37e  rclone-v1.63.1-freebsd-amd64.zip
    70  ...
    71  66ca083757fb22198309b73879831ed2b42309892394bf193ff95c75dff69c73  rclone-v1.63.1-windows-amd64.zip
    72  bbb47c16882b6c5f2e8c1b04229378e28f68734c613321ef0ea2263760f74cd0  rclone-v1.63.1-windows-arm64.zip
    73  -----BEGIN PGP SIGNATURE-----
    74  
    75  iF0EARECAB0WIQT79zfs6firGGBL0qyTk14C/ztU+gUCZLVKJQAKCRCTk14C/ztU
    76  +pZuAJ0XJ+QWLP/3jCtkmgcgc4KAwd/rrwCcCRZQ7E+oye1FPY46HOVzCFU3L7g=
    77  =8qrL
    78  -----END PGP SIGNATURE-----
    79  ```
    80  
    81  ### Download the files
    82  
    83  The first step is to download the binary and SUMs file and verify that
    84  the SUMs you have downloaded match. Here we download
    85  `rclone-v1.63.1-windows-amd64.zip` - choose the binary (or binaries)
    86  appropriate to your architecture. We've also chosen the `SHA256SUMS`
    87  as these are the most secure. You could verify the other types of hash
    88  also for extra security. `rclone selfupdate` verifies just the
    89  `SHA256SUMS`.
    90  
    91  ```
    92  $ mkdir /tmp/check
    93  $ cd /tmp/check
    94  $ rclone copy --http-url https://downloads.rclone.org/v1.63.1 :http:SHA256SUMS .
    95  $ rclone copy --http-url https://downloads.rclone.org/v1.63.1 :http:rclone-v1.63.1-windows-amd64.zip .
    96  ```
    97  
    98  ### Verify the signatures
    99  
   100  First verify the signatures on the SHA256 file.
   101  
   102  Import the key. See above for ways to verify this key is correct.
   103  
   104  ```
   105  $ gpg --keyserver keyserver.ubuntu.com --receive-keys FBF737ECE9F8AB18604BD2AC93935E02FF3B54FA
   106  gpg: key 93935E02FF3B54FA: public key "Nick Craig-Wood <nick@craig-wood.com>" imported
   107  gpg: Total number processed: 1
   108  gpg:               imported: 1
   109  ```
   110  
   111  Then check the signature:
   112  
   113  ```
   114  $ gpg --verify SHA256SUMS 
   115  gpg: Signature made Mon 17 Jul 2023 15:03:17 BST
   116  gpg:                using DSA key FBF737ECE9F8AB18604BD2AC93935E02FF3B54FA
   117  gpg: Good signature from "Nick Craig-Wood <nick@craig-wood.com>" [ultimate]
   118  ```
   119  
   120  Verify the signature was good and is using the fingerprint shown above.
   121  
   122  Repeat for `MD5SUMS` and `SHA1SUMS` if desired.
   123  
   124  ### Verify the hashes
   125  
   126  Now that we know the signatures on the hashes are OK we can verify the
   127  binaries match the hashes, completing the verification.
   128  
   129  ```
   130  $ sha256sum -c SHA256SUMS 2>&1 | grep OK
   131  rclone-v1.63.1-windows-amd64.zip: OK
   132  ```
   133  
   134  Or do the check with rclone
   135  
   136  ```
   137  $ rclone hashsum sha256 -C SHA256SUMS rclone-v1.63.1-windows-amd64.zip 
   138  2023/09/11 10:53:58 NOTICE: SHA256SUMS: improperly formatted checksum line 0
   139  2023/09/11 10:53:58 NOTICE: SHA256SUMS: improperly formatted checksum line 1
   140  2023/09/11 10:53:58 NOTICE: SHA256SUMS: improperly formatted checksum line 49
   141  2023/09/11 10:53:58 NOTICE: SHA256SUMS: 4 warning(s) suppressed...
   142  = rclone-v1.63.1-windows-amd64.zip
   143  2023/09/11 10:53:58 NOTICE: Local file system at /tmp/check: 0 differences found
   144  2023/09/11 10:53:58 NOTICE: Local file system at /tmp/check: 1 matching files
   145  ```
   146  
   147  ### Verify signatures and hashes together
   148  
   149  You can verify the signatures and hashes in one command line like this:
   150  
   151  ```
   152  $ gpg --decrypt SHA256SUMS | sha256sum -c --ignore-missing
   153  gpg: Signature made Mon 17 Jul 2023 15:03:17 BST
   154  gpg:                using DSA key FBF737ECE9F8AB18604BD2AC93935E02FF3B54FA
   155  gpg: Good signature from "Nick Craig-Wood <nick@craig-wood.com>" [ultimate]
   156  gpg:                 aka "Nick Craig-Wood <nick@memset.com>" [unknown]
   157  rclone-v1.63.1-windows-amd64.zip: OK
   158  ```