Signed Binary

All binary files made available by us are also signed (.sig file). That is, there are two files: the binary and the signature file. This method improves security, as the origin of that file can be trusted and guarantees the file's integrity. To verify the source of the file, first, you need to download Vitro code signing certificate:

curl -o sign_ca.crt "https://cloud.3mdeb.com/index.php/s/dGdXC8ZyPmmj8ok/download"

📘
cURL is a program that allows you and the server to transfer data among each other. In this case, we are downloading a file.

The first thing you should do is inspect the certificate to see if it is valid. You can do that by going to the Inspecting the Certificate section. If the certificate is fine, now you need to extract the public key:

openssl x509 -in sign_ca.crt -pubkey -noout > vitro_code_signing.pubkey

If you trust the certificate, you can now verify all downloaded binaries if they are trustworthy or not. The command is:

$ openssl dgst -sha256 -verify vitro_code_signing.pubkey -signature <signature_file>.sig <binary_file>

For example, consider you download the SDK binary and want to verify it using its signature file. The first step is to download it:

curl -o shard-sdk.a "https://cloud.3mdeb.com/index.php/s/e4cCgADpjrTQkcY/download"
curl -o shard-sdk.a.sig "https://cloud.3mdeb.com/index.php/s/JALgKH33JS5izHq/download"

After the download is finished, just run the following command to check its signature:

$ openssl dgst -sha256 -verify vitro_code_signing.pubkey -signature shard-sdk.a.sig shard-sdk.a

The output, hopefully, will be:

Verified OK

Inspecting the Certificate

You can inspect the certificate on the command-line by using the openssl tool. On Ubuntu, Windows, and macOS, it is also possible to double click on the .crt file to open it.

openssl x509 -text -noout -in sign_ca.crt

There are four main fields that you must pay attention to:

Issuer

Issuer: C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert SHA2 Assured ID Code Signing CA

Here we can check that the certificate was issued by DigiCert.

Validity

Validity
   Not Before: May 20 00:00:00 2021 GMT
   Not After : Mar  8 23:59:59 2022 GMT

In this field, we can verify if the certificate is still valid or not. In this case, it is until March 8, 2022.

Subject

Subject: C = US, ST = Texas, L = Austin, O = Vitro Technology Corporation, CN = Vitro Technology Corporation

The same information can be obtained if you double click the certificate, as shown below:

822 — Ubuntu's certification information page.

Finally, the subject shows that the certificate was issued for Vitro Technology Corporation.

You can also check the certificate by using certificate decoders online. An example is the one from GoDaddy. You should open the sign_ca.crt file in a text editor and paste the content to the decoder window. For example, the content to copy and paste is:

This will result in the following:

1115 — GoDaddy's certification information page.