Skip to content

Commit 8f2d5ad

Browse files
author
Anthony Sansone
committed
(DOCS-10909): Added verification for Windows build.
1 parent 7e08223 commit 8f2d5ad

File tree

2 files changed

+143
-13
lines changed

2 files changed

+143
-13
lines changed

‎source/includes/steps-install-verify-files-windows.yaml

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
title: Download the Signature Check utility from Microsoft.
2+
stepnum: 1
3+
level: 4
4+
ref: download-sigcheck
5+
content: |
6+
a. Visit the `Sigcheck utility page <https://docs.microsoft.com/en-us/sysinternals/downloads/sigcheck>`__.
7+
8+
b. Click the :guilabel:`Download Sigcheck` link.
9+
10+
c. Unzip ``Sigcheck.zip``.
11+
12+
d. Move the Sigcheck directory to an appropriate location on your
13+
Windows host.
14+
15+
For this tutorial, this location is
16+
``$Env:ProgramFiles\Sigcheck``.
17+
---
18+
title: Download the MongoDB installation file.
19+
stepnum: 2
20+
level: 4
21+
ref: download-install-file
22+
content: |
23+
Download the binaries from ``https://www.mongodb.org/downloads``.
24+
25+
.. example::
26+
27+
To download the ``v3.4-latest`` release for Windows using
28+
Powershell, invoke this command:
29+
30+
.. code-block:: powershell
31+
32+
Invoke-WebRequest -Uri "https://downloads.mongodb.org/win32/mongodb-win32-x86_64-2008plus-ssl-v3.4-latest-signed.msi" `
33+
-OutFile "$Env:HomePath\Downloads\mongodb-win32-x86_64-2008plus-ssl-v3.4-latest-signed.msi"
34+
35+
---
36+
title: Download the public signature file.
37+
stepnum: 3
38+
level: 4
39+
ref: download-sig-file
40+
content: |
41+
Download the ``md5`` from ``https://www.mongodb.org/downloads``.
42+
43+
.. example::
44+
45+
To download the SHA256 signature for the ``v3.4-latest`` release
46+
for Windows using Powershell, invoke this command:
47+
48+
.. code-block:: powershell
49+
50+
Invoke-WebRequest -Uri "https://downloads.mongodb.org/win32/mongodb-win32-x86_64-2008plus-ssl-v3.4-latest-signed.msi.sha256" `
51+
-OutFile "$Env:HomePath\Downloads\mongodb-win32-x86_64-2008plus-ssl-v3.4-latest-signed.msi.sha256"
52+
---
53+
title: Verify the signature of the MongoDB installer.
54+
stepnum: 4
55+
level: 4
56+
ref: verify-sig
57+
content: |
58+
59+
Invoke ``sigcheck``:
60+
61+
.. code-block:: powershell
62+
63+
$Env:ProgramFiles\Sigcheck\sigcheck64.exe `
64+
-h $Env:HomePath\Downloads\mongodb-win32-x86_64-2008plus-ssl-v3.4-latest-signed.msi
65+
66+
``sigcheck`` returns this verifcation information for the latest
67+
release of MongoDB 3.4:
68+
69+
.. code-block:: bat
70+
:emphasize-lines: 19
71+
72+
Sigcheck v2.60 - File version and signature viewer
73+
Copyright (C) 2004-2017 Mark Russinovich
74+
Sysinternals - www.sysinternals.com
75+
76+
$Env:HomePath\downloads\mongodb-win32-x86_64-2008plus-ssl-v3.4-latest-signed.msi:
77+
Verified: Signed
78+
Signing date: 12:34 AM 6/20/2018
79+
Publisher: MongoDB, Inc.
80+
Company: n/a
81+
Description: n/a
82+
Product: n/a
83+
Prod version: n/a
84+
File version: n/a
85+
MachineType: n/a
86+
MD5: D7866C013989AEE2FA87774EFFF884F0
87+
SHA1: E5D7D78E8FFFF9CFF3BD605C3407A55F87F4C8DD
88+
PESHA1: E5D7D78E8FFFF9CFF3BD605C3407A55F87F4C8DD
89+
PE256: 8FE0670DF2AB74CCD33910C0AF2F000225BA2ED21330767D95E3F6DED96E6893
90+
SHA256: 8FE0670DF2AB74CCD33910C0AF2F000225BA2ED21330767D95E3F6DED96E6893
91+
IMP: n/a
92+
93+
---
94+
title: Compare the Signature File to the MongoDB Installer Hash.
95+
stepnum: 5
96+
level: 4
97+
ref: download-key-file
98+
content: |
99+
100+
To compare the signature file to the hash of the MongoDB binary,
101+
invoke this Powershell script:
102+
103+
.. code-block:: powershell
104+
105+
$sigHash = (Get-Content $Env:HomePath\Downloads\mongodb-win32-x86_64-2008plus-ssl-v3.4-latest-signed.msi.sha256 | Out-String).SubString(0,64).ToUpper(); `
106+
$fileHash = (Format-Table -Property Hash -InputObject (Get-FileHash $Env:HomePath\Downloads\mongodb-win32-x86_64-2008plus-ssl-v3.4-latest-signed.msi) -hidetableheaders | Out-String).Trim(); `
107+
echo $sigHash; echo $fileHash; `
108+
$sigHash -eq $fileHash
109+
110+
.. code-block:: bat
111+
:emphasize-lines: 1-2
112+
113+
8FE0670DF2AB74CCD33910C0AF2F000225BA2ED21330767D95E3F6DED96E6893
114+
8FE0670DF2AB74CCD33910C0AF2F000225BA2ED21330767D95E3F6DED96E6893
115+
True
116+
117+
The command outputs three lines:
118+
119+
- An SHA256 hash that you downloaded directly from MongoDB.
120+
- An SHA256 hash computed from the MongoDB binary you
121+
downloaded from MongoDB.
122+
- A ``True`` or ``False`` result depending if the hashes match.
123+
124+
If hashes match, the MongoDB binary is verified.
125+
...

‎source/tutorial/verify-mongodb-packages.txt

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -10,34 +10,39 @@ Verify Integrity of MongoDB Packages
1010
:depth: 1
1111
:class: singlecol
1212

13-
Overview
14-
--------
15-
1613
The MongoDB release team digitally signs all software packages to
1714
certify that a particular MongoDB package is a valid and unaltered
18-
MongoDB release. Before installing MongoDB, you should validate the package
19-
using either the provided PGP signature or SHA-256 checksum.
15+
MongoDB release. Before installing MongoDB, you should validate the
16+
package using either the provided PGP signature or SHA-256 checksum.
2017

2118
PGP signatures provide the strongest guarantees by checking both the
2219
authenticity and integrity of a file to prevent tampering.
2320

2421
Cryptographic checksums only validate file integrity to prevent network
2522
transmission errors.
2623

27-
Procedures
28-
----------
24+
Verify Linux/macOS Packages
25+
---------------------------
2926

3027
Use PGP/GPG
31-
+++++++++++
28+
~~~~~~~~~~~
3229

33-
MongoDB signs each release branch with a different PGP key. The public key files
34-
for each release branch since MongoDB 2.2 are available for download
35-
from the `key server <https://www.mongodb.org/static/pgp/>`_ in both textual
36-
``.asc`` and binary ``.pub`` formats.
30+
MongoDB signs each release branch with a different PGP key. The public
31+
key files for each release branch since MongoDB 2.2 are available for
32+
download from the `key server <https://www.mongodb.org/static/pgp/>`_
33+
in both textual ``.asc`` and binary ``.pub`` formats.
3734

3835
.. include:: /includes/steps/install-verify-files-pgp.rst
3936

4037
Use SHA-256
41-
+++++++++++
38+
~~~~~~~~~~~
4239

4340
.. include:: /includes/steps/install-verify-files-sha.rst
41+
42+
Verify Windows Packages
43+
-----------------------
44+
45+
This verifies the MongoDB binary against its SHA256 key. This tutorial
46+
uses the latest release of MongoDB Community Edition 3.4.
47+
48+
.. include:: /includes/steps/install-verify-files-windows.rst

0 commit comments

Comments
 (0)