Skip to content

Commit 3c639d6

Browse files
kanchana-mongodbkanchana-mongodb
authored
Merge pull request #436 from kanchana-mongodb/DOCSP-40387
DOCSP-40387 Add Verification section to BI Connector installation pages
2 parents fb1c86e + a0fb599 commit 3c639d6

File tree

4 files changed

+247
-3
lines changed

4 files changed

+247
-3
lines changed

‎source/includes/steps-install-bi-connector-debian.yaml

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,79 @@ source:
66
ref: download-bi
77
---
88
stepnum: 2
9+
title: Verify the integrity of the downloaded package.
10+
ref: verify-bi-debian-package
11+
level: 4
12+
content: |
13+
The MongoDB release team digitally signs all software packages to
14+
certify that a particular MongoDB package is a valid and unaltered
15+
MongoDB release. The `bi-connector.asc` key to validate the BI
16+
Connector is available on `pgp.mongodb.com <https://pgp.mongodb.com/bi-connector.asc>`__
17+
as a PGP key in ``.asc`` format.
18+
19+
a. Run the following command to download the ``.sig`` file.
20+
21+
.. code-block:: sh
22+
23+
curl -LO https://info-mongodb-com.s3.amazonaws.com/mongodb-bi/v2/mongodb-bi-linux-{arch}-{platform}-{version}.tgz.sig
24+
25+
.. example::
26+
27+
.. code-block:: sj
28+
29+
https://info-mongodb-com.s3.amazonaws.com/mongodb-bi/v2/mongodb-bi-linux-x86_64-suse12-v2.14.14.tgz.sig
30+
31+
#. Run the following command to download the import the key file.
32+
33+
.. io-code-block::
34+
:copyable: true
35+
36+
.. input::
37+
:language: shell
38+
39+
curl -LO https://pgp.mongodb.com/bi-connector.asc
40+
gpg --import bi-connector.asc
41+
42+
.. output::
43+
:language: shell
44+
45+
gpg: key 1CCF1A1263CDD699: public key "MongoDB BI Connector Release Signing Key <[email protected]>" imported
46+
gpg: Total number processed: 1
47+
gpg: imported: 1
48+
49+
#. Run the following command to verify the MongoDB installation file.
50+
51+
.. code-block::
52+
53+
gpg --verify tar -xvzf mongodb-bi-linux-{arch}-{platform}-{version}.tgz.sig tar -xvzf mongodb-bi-linux-{arch}-{platform}-{version}.tgz
54+
55+
GPG should return this response:
56+
57+
.. code-block:: shell
58+
59+
gpg: Signature made Thu Jun 13 10:17:03 2024 PDT
60+
gpg: using RSA key BD66803ABD3EB56953142EE51CCF1A1263CDD699
61+
gpg: Good signature from "MongoDB BI Connector Release Signing Key <[email protected]>" [unknown]
62+
63+
If the package is properly signed, but you do not currently trust
64+
the signing key in your local ``trustdb``, ``gpg`` will also return
65+
the following message:
66+
67+
.. code-block:: shell
68+
69+
gpg: WARNING: This key is not certified with a trusted signature!
70+
gpg: There is no indication that the signature belongs to the owner.
71+
Primary key fingerprint: BD66 803A BD3E B569 5314 2EE5 1CCF 1A12 63CD D699
72+
73+
If you receive the following error message, confirm that you
74+
imported the correct public key:
75+
76+
.. code-block:: shell
77+
78+
gpg: Can't check signature: public key not found
79+
80+
---
81+
stepnum: 3
982
title: Install the |bi|.
1083
ref: install-bi-debian
1184
level: 4

‎source/includes/steps-install-bi-connector-macos.yaml

Lines changed: 71 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,74 @@ source:
66
ref: download-bi
77
---
88
stepnum: 2
9+
title: Verify the integrity of the downloaded package.
10+
ref: verify-bi-mac-package
11+
level: 4
12+
content: |
13+
The MongoDB release team digitally signs all software packages to
14+
certify that a particular MongoDB package is a valid and unaltered
15+
MongoDB release. The `bi-connector.asc` key to validate the BI
16+
Connector is available on `pgp.mongodb.com <https://pgp.mongodb.com/bi-connector.asc>`__
17+
as a PGP key in ``.asc`` format.
18+
19+
a. Run the following command to downloaded the ``.sig`` file.
20+
21+
.. code-block:: sh
22+
23+
curl -LO https://info-mongodb-com.s3.amazonaws.com/mongodb-bi/v2/mongodb-bi-osx-{x86_64|arm64-macos{11|13}}-{version}.zip.sig
24+
25+
#. Run the following command to download the import key file.
26+
27+
.. io-code-block::
28+
:copyable: true
29+
30+
.. input::
31+
:language: shell
32+
33+
curl -LO https://pgp.mongodb.com/bi-connector.asc
34+
gpg --import bi-connector.asc
35+
36+
.. output::
37+
:language: shell
38+
39+
gpg: key 1CCF1A1263CDD699: public key "MongoDB BI Connector Release Signing Key <[email protected]>" imported
40+
gpg: Total number processed: 1
41+
gpg: imported: 1
42+
43+
#. Run the following command to verify the MongoDB installation file.
44+
45+
.. code-block:: shell
46+
47+
gpg --verify mongodb-bi-osx-{x86_64|arm64-macos{11|13}}-{version}.zip.sig mongodb-bi-osx-{x86_64|arm64-macos{11|13}}-{version}.zip
48+
49+
50+
GPG should return this response:
51+
52+
.. code-block:: shell
53+
54+
gpg: Signature made Thu Jun 13 10:17:03 2024 PDT
55+
gpg: using RSA key BD66803ABD3EB56953142EE51CCF1A1263CDD699
56+
gpg: Good signature from "MongoDB BI Connector Release Signing Key <[email protected]>" [unknown]
57+
58+
If the package is properly signed, but you do not currently trust
59+
the signing key in your local ``trustdb``, ``gpg`` will also return
60+
the following message:
61+
62+
.. code-block:: shell
63+
64+
gpg: WARNING: This key is not certified with a trusted signature!
65+
gpg: There is no indication that the signature belongs to the owner.
66+
Primary key fingerprint: BD66 803A BD3E B569 5314 2EE5 1CCF 1A12 63CD D699
67+
68+
If you receive the following error message, confirm that you
69+
imported the correct public key:
70+
71+
.. code-block:: shell
72+
73+
gpg: Can't check signature: public key not found
74+
75+
---
76+
stepnum: 3
977
title: Install the |bi|.
1078
ref: install-bi-mac
1179
level: 4
@@ -19,15 +87,15 @@ content: |
1987
2088
.. code-block:: sh
2189
22-
unzip {SOURCE-PATH}/mongodb-bi-osx-x86_64-{version}.zip -d {DESTINATION-PATH}
90+
unzip {SOURCE-PATH}/mongodb-bi-osx-{x86_64|arm64-macos{11|13}}-{version}.zip -d {DESTINATION-PATH}
2391
24-
b. Change to the ``mongodb-bi-osx-x86_64-{version}`` directory.
92+
b. Change to the ``mongodb-bi-osx-{x86_64|arm64-macos{11|13}}-{version}`` directory.
2593
Replace {DESTINATION-PATH} with the path to the directory
2694
where you extracted the archive in the previous step.
2795
2896
.. code-block:: sh
2997
30-
cd {DESTINATION-PATH}/mongodb-bi-osx-x86_64-{version}/
98+
cd {DESTINATION-PATH}/mongodb-bi-osx-{x86_64|arm64-macos{11|13}}-{version}/
3199
32100
c. Install the programs within the ``bin/`` directory into a directory
33101
listed in your system ``PATH``. If a prior version exists,

‎source/includes/steps-install-bi-connector-rhel.yaml

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,79 @@ source:
66
ref: download-bi
77
---
88
stepnum: 2
9+
title: Verify the integrity of the downloaded package.
10+
ref: verify-bi-rhel-package
11+
level: 4
12+
content: |
13+
The MongoDB release team digitally signs all software packages to
14+
certify that a particular MongoDB package is a valid and unaltered
15+
MongoDB release. The `bi-connector.asc` key to validate the BI
16+
Connector is available on `pgp.mongodb.com
17+
<https://pgp.mongodb.com/bi-connector.asc>`__ as a PGP key in ``.asc`` format.
18+
19+
a. Run the following command to downloaded the ``.sig`` file.
20+
21+
.. code-block:: sh
22+
23+
curl -LO https://info-mongodb-com.s3.amazonaws.com/mongodb-bi/v2/mongodb-bi-linux-{arch}-{platform}-{version}.tgz.sig
24+
25+
.. example::
26+
27+
.. code-block:: sh
28+
29+
https://info-mongodb-com.s3.amazonaws.com/mongodb-bi/v2/mongodb-bi-linux-x86_64-rhel90-v2.14.14.tgz.sig
30+
31+
#. Run the following command to download the import the key file.
32+
33+
.. io-code-block::
34+
:copyable: true
35+
36+
.. input::
37+
:language: shell
38+
39+
curl -LO https://pgp.mongodb.com/bi-connector.asc
40+
gpg --import bi-connector.asc
41+
42+
.. output::
43+
:language: shell
44+
45+
gpg: key 1CCF1A1263CDD699: public key "MongoDB BI Connector Release Signing Key <[email protected]>" imported
46+
gpg: Total number processed: 1
47+
gpg: imported: 1
48+
49+
#. Run the following command to verify the MongoDB installation file.
50+
51+
.. code-block::
52+
53+
gpg --verify tar -xvzf mongodb-bi-linux-{arch}-{platform}-{version}.tgz.sig tar -xvzf mongodb-bi-linux-{arch}-{platform}-{version}.tgz
54+
55+
GPG should return this response:
56+
57+
.. code-block:: shell
58+
59+
gpg: Signature made Thu Jun 13 10:17:03 2024 PDT
60+
gpg: using RSA key BD66803ABD3EB56953142EE51CCF1A1263CDD699
61+
gpg: Good signature from "MongoDB BI Connector Release Signing Key <[email protected]>" [unknown]
62+
63+
If the package is properly signed, but you do not currently trust
64+
the signing key in your local ``trustdb``, ``gpg`` will also return
65+
the following message:
66+
67+
.. code-block:: shell
68+
69+
gpg: WARNING: This key is not certified with a trusted signature!
70+
gpg: There is no indication that the signature belongs to the owner.
71+
Primary key fingerprint: BD66 803A BD3E B569 5314 2EE5 1CCF 1A12 63CD D699
72+
73+
If you receive the following error message, confirm that you
74+
imported the correct public key:
75+
76+
.. code-block:: shell
77+
78+
gpg: Can't check signature: public key not found
79+
80+
---
81+
stepnum: 3
982
title: Install the |bi|.
1083
ref: install-bi-server
1184
level: 4

‎source/includes/steps-install-bi-connector-windows.yaml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,36 @@ source:
66
ref: download-bi
77
---
88
stepnum: 2
9+
title: Verify the integrity of the downloaded package.
10+
ref: verify-bi-windows-package
11+
level: 4
12+
content: |
13+
The MongoDB release team digitally signs all software packages to
14+
certify that a particular MongoDB package is a valid and unaltered
15+
MongoDB release. Complete the following steps to verify the MongoDB
16+
binary against its SHA256 key:
17+
18+
a. Download the ``.sha256`` file for Windows x64 from `BI Connector
19+
Downloads page <https://www.mongodb.com/try/download/bi-connector/releases>`__.
20+
#. Compare the signature file to the MongoDB installer hash using the
21+
following Powershell script:
22+
23+
.. code-block:: shell
24+
25+
$sigHash = (Get-Content $Env:HomePath\Downloads\mongodb-bi-win32-x86_64-{version}.msi.sha256 | Out-String).SubString(0,64).ToUpper(); `
26+
$fileHash = (Get-FileHash $Env:HomePath\Downloads\mongodb-bi-win32-x86_64-{version}.msi).Hash.Trim(); `
27+
echo $sigHash; echo $fileHash; `
28+
$sigHash -eq $fileHash
29+
30+
The command outputs three lines:
31+
32+
- A SHA256 hash that you downloaded directly from MongoDB.
33+
- A SHA256 hash computed from the MongoDB binary you downloaded from MongoDB.
34+
- A True or False result depending if the hashes match.
35+
36+
If the hashes match, the MongoDB binary is verified.
37+
---
38+
stepnum: 3
939
title: Install the |bi|.
1040
ref: install-bi-windows
1141
level: 4

0 commit comments

Comments
 (0)