PowerScale OneFS 9.8.0.0 Web Administration Guide

Validate the AMI signature

You must verify a signed manifest using OpenSSL. A signed manifest is a file that contains information about the files in a package and a digital signature to ensure the integrity and authenticity of the package. The procedure includes extracting the certificate and public key, converting the signature file to a binary, and verifying the signature using OpenSSL.

Verifying a signed manifest using OpenSSL ensures the integrity and authenticity of a package. By using the following steps, you can verify the signed manifest and ensure that the package is valid.

Prerequisites

Before verifying the signed manifest, ensure that the following prerequisites are met:

• OpenSSL is installed on the system.
• The signed manifest (.rsig) file and certificate (.rcerts) files are available.

Procedure

Follow the steps below to verify the signed manifest:

1. Extract the cer.pem from the certificate file (.rcerts) using the command: openssl x509 -in <certificate file> -out cert.pem. For example:

   openssl x509 -in onefs-x.x.x.x-391768d-manifest.txt.rcerts -out cert.pem

2. Extract the public key from the certificate file (cert.pem) using the command,. For example:

   openssl x509 -pubkey -noout -in cert.pem > pubkey.pem

3. Convert the signature file (.rsig) to binary using the command: openssl base64 -d -in <signature file> -out <signature file>-binary. For example:

   openssl base64 -d -in onefs-x.x.x.x-391768d-manifest.txt.rsig -out onefs-x.x.x.x-391768d-manifest.txt.rsig-binary 

4. Verify the signature using the public key and the binary signature file using the command: openssl dgst -sha256 -verify pubkey.pem -signature <binary signature file> <signed manifest file>. For example:

   openssl dgst -sha256 -verify pubkey.pem -signature onefs-x.x.x.x-391768d-manifest.txt.rsig-binary onefs-x.x.x.x-391768d-manifest.txt

   If the signature is valid, the command displays Verified OK.