44 lines
1.7 KiB
Markdown
44 lines
1.7 KiB
Markdown
# Verify a release
|
|
|
|
Verify a downloaded release before writing its images to a cartridge or internal
|
|
disk. Verification checks the release manifest signature and the length and
|
|
SHA-256 of every listed artifact. Obtain the signer's public key through a
|
|
trusted channel independent of the download.
|
|
|
|
On a workstation, build the verifier with `make signing` after bootstrap. On FDS,
|
|
`fds-release` is included in the base system and recovery.
|
|
|
|
## Verify before using images
|
|
|
|
Obtain the signer's public key through a channel you already trust, or compare
|
|
its fingerprint against a separately authenticated value. A public key included
|
|
beside an untrusted download does not establish its identity by itself.
|
|
|
|
On FDS, including recovery:
|
|
|
|
```sh
|
|
fds-release verify /data/downloads/fds-release --key /data/keys/fds-release.pub
|
|
```
|
|
|
|
On the workstation, use the host executable instead:
|
|
|
|
```sh
|
|
target/x86_64-unknown-linux-gnu/release/fds-release verify \
|
|
/path/to/release-directory --key /path/to/trusted-fds-release.pub
|
|
```
|
|
|
|
Signature verification is an explicit pre-installation step. It is not enforced
|
|
by Pi firmware or stage0 during boot.
|
|
|
|
Success reports `VERIFIED` and identifies the release. Failure returns a nonzero
|
|
exit code with an explanation. Keep files unchanged between verification and
|
|
writing. Files absent from the signed manifest are outside its scope.
|
|
|
|
The cartridge writer separately checks image layout, destination identity and
|
|
readback. Release verification does not install images; follow the
|
|
[USB-writing workflow](workstation.md#write-a-cartridge-to-usb) or
|
|
[internal installation](internal-storage.md).
|
|
|
|
Release maintainers can find key creation, signing and format details in the
|
|
[developer reference](developer/releases.md).
|