Skip to main content
Version: 0.4.0

How to sign and verify Gravitino releases

These instructions provide a guide to signing and verifying Gravitino releases to enhance the security of releases. A signed release enables people to confirm the author of the release and guarantees that the code hasn't been altered.

Prerequisites

Before signing or verifying a Gravitino release, ensure you have the following prerequisites installed:

  • GPG/GnuPG
  • Release artifacts

Platform support

These instructions are for macOS. You may need to make adjustments for other platforms.

  1. How to Install GPG or GnuPG:

    GnuPG is an open-source implementation of the OpenPGP standard and allows you to encrypt and sign files or emails. GnuPG, also known as GPG, is a command line tool.

    Check to see if GPG is installed by running the command:

    gpg -help

    If GPG/GnuPG isn't installed, run the following command to install it. You only need to do this step once.

    brew install gpg

Signing a release

  1. Create a Public/Private Key Pair:

    Check to see if you already have a public/private key pair by running the command:

    gpg --list-secret-keys

    If you get no output, you'll need to generate a public/private key pair.

    Use this command to generate a public/private key pair. This is a one-time process. Setting the key expiry to 5 years and omitting a comment. All other defaults are acceptable.

    gpg --full-generate-key

    Here is an example of generating a public/private key pair by using the previous command.

    gpg (GnuPG) 2.4.3; Copyright (C) 2023 g10 Code GmbH
    This is free software: you are free to change and redistribute it.
    There is NO WARRANTY, to the extent permitted by law.

    Please select what kind of key you want:
    (1) RSA and RSA
    (2) DSA and Elgamal
    (3) DSA (sign only)
    (4) RSA (sign only)
    (9) ECC (sign and encrypt) *default*
    (10) ECC (sign only)
    (14) Existing key from card
    Your selection?
    Please select which elliptic curve you want:
    (1) Curve 25519 *default*
    (4) NIST P-384
    (6) Brainpool P-256
    Your selection?
    Please specify how long the key should be valid.
    0 = key does not expire
    <n> = key expires in n days
    <n>w = key expires in n weeks
    <n>m = key expires in n months
    <n>y = key expires in n years
    Key is valid for? (0) 5y
    Key expires at Mon 13 Nov 16:08:58 2028 AEDT
    Is this correct? (y/N) y

    GnuPG needs to construct a user ID to identify your key.

    Real name: John Smith
    Email address: john@datastrato.com
    Comment:
    You selected this USER-ID:
    "John Smith <john@datastrato.com>"

    Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
    We need to generate a lot of random bytes. It is a good idea to perform
    some other action (type on the keyboard, move the mouse, utilize the
    disks) during the prime generation; this gives the random number
    generator a better chance to gain enough entropy.
    We need to generate a lot of random bytes. It is a good idea to perform
    some other action (type on the keyboard, move the mouse, utilize the
    disks) during the prime generation; this gives the random number
    generator a better chance to gain enough entropy.
    gpg: revocation certificate stored as '/Users/justin/.gnupg/openpgp-revocs.d/CC6BD9B0A3A31A7ACFF9E1383DF672F671B7F722.rev'
    public and secret key created and signed.

    pub ed25519 2023-11-15 [SC] [expires: 2028-11-13]
    CC6BD9B0A3A31A7ACFF9E1383DF672F671B7F722
    uid John Smith <john@datastrato.com>
    sub cv25519 2023-11-15 [E] [expires: 2028-11-13]
important

Keep your private key secure and saved somewhere other than just on your computer. Don't forget your key password, and also securely record it somewhere. If you lose your keys or forget your password, you won't be able to sign releases.

  1. Sign a release:

    To sign a release, use the following command for each release file:

    gpg --detach-sign --armor <filename>.[zip|tar.gz]

    For example, to sign the Gravitino 0.2.0 release you would use this command.

    gpg --detach-sign --armor gravitino.0.2.0.zip

    This generates an .asc file containing a PGP signature. Anyone can use this file and your public signature to verify the release.

  2. Generate hashes for a release:

    Use the following command to generate hashes for a release:

    shasum -a 256 <filename>.[zip|tar.gz] > <filename>.[zip|tar.gz].sha256

    For example, to generate a hash for the Gravitino 0.2.0 release you would use this command:

    shasum -a 256 gravitino.0.2.0.zip > gravitino.0.2.0.zip.sha256
  3. Copy your public key to the KEYS file:

    The KEYS file contains public keys used to sign previous releases. You only need to do this step once. Execute the following command to copy your public key to a KEY file and then append your KEY to the KEYS file. The KEYS file contains all the public keys used to sign previous releases.

    gpg --output KEY --armor --export <youremail>
    cat KEY >> KEYS
  4. Publish hashes and signatures:

    Upload the generated .asc and .sha256 files along with the release artifacts and KEYS file to the release area.

Verifying a release

  1. Import public keys:

    Download the KEYS file. Import the public keys used to sign all previous releases with this command. It doesn't matter if you have already imported the keys.

    gpg --import KEYS
  2. Verify the signature:

    Download the .asc and release files. Use the following command to verify the signature:

    gpg --verify <filename>.[zip|tar.gz].asc

    The output should contain the text "Good signature from ...".

    For example to verify the Gravitino 0.2.0 zip file you would use this command:

     gpg --verify gravitino.0.2.0.zip.asc
  3. Verify the hashes:

    Check if the hashes match, using the following command:

    diff -u <filename>.[zip|tar.gz].sha256 <(shasum -a 256 <filename>.[zip|tar.gz])

    For example to verify the Gravitino 2.0 zip file you would use this command:

    diff -u gravitino.0.2.0.zip.sha256 <(shasum -a 256 gravitino.0.2.0.zip)

    This command ensures that the signatures match and that there are no differences between them.