Hodei-Shield Agent: verify a release before you install it¶
Every release publishes SHA256SUMS (the SHA-256 of each file) and
SHA256SUMS.sig, an Ed25519 signature over that file made with the Hodeitek
release key. A hash downloaded from the same place as the file proves nothing
by itself; the signature does. Check the signature first, then the hash. If any
check fails, do not install: delete the files and write to info@hodeitek.com.
The release public key¶
Save as hodei-shield-release.pub.pem. The same key is built into every agent.
-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEAEUqKd+ot7BESwk+vf6EVBKudMi6F6jmY3dJeHXfCWkQ=
-----END PUBLIC KEY-----
8b730d2fcbd90e2656bd9b3f265638f1e8e8ac2379d48b0636feb5efe5a88f07. Compare it
with the one printed by Hodeitek through a second channel before trusting a copy
of this page. Where OpenSSL 3 is available:
openssl pkey -pubin -in hodei-shield-release.pub.pem -outform DER | tail -c 32 | sha256sum
Linux (OpenSSL 3, sha256sum)¶
MEASURED with OpenSSL 3.5 on a published release.
V=<version>; B=https://hs-agent-releases.s3.gra.io.cloud.ovh.net
curl -fsSLO "$B/agent/$V/SHA256SUMS" -O "$B/agent/$V/SHA256SUMS.sig" -O "$B/agent/$V/hodei-shield-$V-linux-x86_64-musl.tar.gz"
openssl base64 -d -A -in SHA256SUMS.sig -out SHA256SUMS.sig.raw # 64 bytes: wc -c < SHA256SUMS.sig.raw
openssl pkeyutl -verify -rawin -pubin -inkey hodei-shield-release.pub.pem -sigfile SHA256SUMS.sig.raw -in SHA256SUMS
sha256sum --ignore-missing -c SHA256SUMS
Signature Verified Successfully, then ...tar.gz: OK. Linux has no
OS-native signature: this check is the proof of authenticity.
macOS (OpenSSL 3 from Homebrew, shasum)¶
NOT RUN on a Mac. The system openssl is LibreSSL; it is not known to verify
Ed25519 with -rawin, so install OpenSSL 3 (brew install openssl@3) and call it by
full path (/opt/homebrew/opt/openssl@3/bin/openssl; /usr/local/opt/... on Intel).
V=<version>; B=https://hs-agent-releases.s3.gra.io.cloud.ovh.net; SSL=/opt/homebrew/opt/openssl@3/bin/openssl
curl -fsSLO "$B/agent/$V/SHA256SUMS" -O "$B/agent/$V/SHA256SUMS.sig" -O "$B/agent/$V/hodei-shield-$V-universal.pkg"
$SSL base64 -d -A -in SHA256SUMS.sig -out SHA256SUMS.sig.raw
$SSL pkeyutl -verify -rawin -pubin -inkey hodei-shield-release.pub.pem -sigfile SHA256SUMS.sig.raw -in SHA256SUMS
grep " hodei-shield-$V-universal\.pkg\$" SHA256SUMS | shasum -a 256 -c -
Signature Verified Successfully, then ...pkg: OK. The .pkg also
carries an Apple Developer ID signature: pkgutil --check-signature on it.
Windows (OpenSSL 3 from Git for Windows, PowerShell)¶
MEASURED on a clean host (the full block, with the install step, is in the
Windows beta guide). Git for Windows ships OpenSSL 3 at the path below.
$V='<version>'; $B='https://hs-agent-releases.s3.gra.io.cloud.ovh.net'; $file="hodei-shield-$V-x86_64.msi"
foreach ($n in $file,'SHA256SUMS','SHA256SUMS.sig') { Invoke-WebRequest "$B/agent/$V/$n" -OutFile $n }
$ssl='C:\Program Files\Git\usr\bin\openssl.exe'
& $ssl base64 -d -A -in SHA256SUMS.sig -out SHA256SUMS.sig.raw
& $ssl pkeyutl -verify -rawin -pubin -inkey hodei-shield-release.pub.pem -sigfile SHA256SUMS.sig.raw -in SHA256SUMS
(Get-FileHash $file -Algorithm SHA256).Hash; Select-String -SimpleMatch $file SHA256SUMS
Get-AuthenticodeSignature .\$file | Format-List Status, SignerCertificate
Signature Verified Successfully; the hash printed must equal the one on
the SHA256SUMS line for your file (case does not matter); Status must be
Valid with subject Hodeitek S.L.. The Authenticode check does not replace
the Ed25519 one: do both.