Metro node: Code Signature Validation Procedure for Metro node

How to validate the signature in the customer environment.

For any given metro node release, there are six files that are used to validate the integrity and authenticity of the software packages.
 

• Two hash files that each contain a list of packages that belong to the release and their hashes in either sha256 or md5 format. An example is: VPlex-7.0.1.02.00.01-sha256-checksums.txt
• Two signature files that each contain a cryptographic signature of the corresponding hash file and the certificate of authenticity that is signed by Dell's private key. These files have the ".sign" extension. An example is VPlex-7.0.1.02.00.01-sha256-checksums.txt.sign.
• A script for verifying the signature and the authenticity of the public key. This file is called "vplex_check_signature."
• A certificate chain file, named "css-cert.pem," used to validate the certificate. 
• A CRL file retrieved from the web
• The root CA file that is added to the chain by the vplex_check_signature script.

Follow the below steps to perform the code sign validation:
 

1. Acquire the root CA and CRL files that are used to validate the certificate that signed the code. If you have configured DNS on your metro node, do this step on the system itself. Otherwise, gather the root CA and CRL on a different system and copy them to the metro node.

$ curl https://web.entrust.com/root-certificates/entrust_g2_ca.cer --output entrust_g2_ca.cer
$ curl http://crl.entrust.net/evcs2.crl --output evcs2.crl

2. Check the validity of the "vplex_check_signature" script. Its hashes are as follows:

• MD5:     a06c0093599411be3a81c70b65f3aa68 vplex_check_signature
• SHA1:    b1611f6bb81efe687e21963a020fc30f1fe3787c vplex_check_signature
• SHA256:  0a83dc67dbe2d6ef2872c833548d8c17f8ff3590a4039e52ed3bed1b79538d65 vplex_check_signature

3. After the root CA and CRL file are downloaded to the same machine as the three files described at the beginning of this article, and the integrity of the "vplex_check_signature" script is verified, run the script to verify the code signatures.

$ ./vplex_check_signature VPlex-<release>-md5-checksums.txt VPlex-<release>-md5-checksums.txt.sign css-cert.pem evcs2.crl entrust_g2_ca.cer
Verified

$ ./vplex_check_signature VPlex-<release>-sha256-checksums.txt VPlex-<release>-sha256-checksums.txt.sign css-cert.pem evcs2.crl entrust_g2_ca.cer
Verified

4. Finally, after verifying that the hash files have not been tampered with, you can verify that the individual packages have not changed with the "vplex_check_hashes" script. The hashes for this script are as follows:

• MD5:     5e00e8ba9e1d678c4cfe44960508239c vplex_check_hashes
• SHA1:    64d09eea2af149efc21d458ce5754bf2eb48b3e9 vplex_check_hashes
• SHA256: 438d38501dc6947f5f125c1bd74d3caa67a5540f4763c66242b6eb03d7f87d76 vplex_check_hashes

$ ./vplex_check_hashes VPlex-<release>-md5-checksums.txt
3b59c2415a29e23e526749943340faa6  VPlex-<release>-management-server-package.tar: Verified
952c9b3b89a6ac701fcb3f0a6ab64b75  VPlex-<release>-director-field-disk-image.tar: Verified
bbdf103f82cddedc80851e3edaf76707  VPlex-<release>-cluster-witness-server.vhd: Verified
c64c8289de5b05074a773a28f0a0d6e9  VPlex-<release>-cluster-witness-server.ova: Verified
8005c0fb66abb95d4e2565b546d96157  VPlex-<release>-manifest.xml: Verified
c70aba3e40f0a1aee4ab65bad62fc036  VPlex-<release>-management-server.iso: Verified
1069e4fdeeb77f41ef497968490956c2  VPlex-<release>-director-firmware-package.tar: Verified
4740964a969acb1502e72752a9dbd223  VPlex-<release>-management-server-field-disk-image.tar: Verified
0cf31f1103f498ce74311979d7972b17  VPlex-<release>.zip: Verified
$ ./vplex_check_hashes VPlex-<release>-sha256-checksums.txt
3b59c2415a29e23e526749943340faa6  VPlex-<release>-management-server-package.tar: Verified
952c9b3b89a6ac701fcb3f0a6ab64b75  VPlex-<release>-director-field-disk-image.tar: Verified
bbdf103f82cddedc80851e3edaf76707  VPlex-<release>-cluster-witness-server.vhd: Verified
c64c8289de5b05074a773a28f0a0d6e9  VPlex-<release>-cluster-witness-server.ova: Verified
8005c0fb66abb95d4e2565b546d96157  VPlex-<release>-manifest.xml: Verified
c70aba3e40f0a1aee4ab65bad62fc036  VPlex-<release>-management-server.iso: Verified
1069e4fdeeb77f41ef497968490956c2  VPlex-<release>-director-firmware-package.tar: Verified
4740964a969acb1502e72752a9dbd223  VPlex-<release>-management-server-field-disk-image.tar: Verified
0cf31f1103f498ce74311979d7972b17  VPlex-<release>.zip: Verified

If you receive "Verified" as output for all the above commands, then your release packages are verified as authentic.