Verify a Release

Documentation for the image tag 1.0.0-rc6. See Versions for the documentation of a release.

Verify a Release

From 1.0.0-rc6, every Qertum release is signed. The container images carry a signature in each registry (Docker Hub, Quay and GHCR), and the release's SHA256SUMS file carries one in SHA256SUMS.sigstore.json. SHA256SUMS lists every other file of the release: the deploy bundle, the qca binaries, the SBOMs and the third-party notices. Earlier releases are not signed.

The public keys are in the signing/ folder of the source repository: qertum-release-primary.pub signs releases, and qertum-release-spare.pub is kept offline in case the primary is lost. Both keys were generated inside a YubiKey and cannot be copied out of it. Signatures are also recorded in the public Sigstore transparency log.

What you need

• cosign 3.0 or later.
• The public key: signing/qertum-release-primary.pub from the source repository (the copy in a release's source archive is the same file).

Check an image

cosign verify --key qertum-release-primary.pub qertum/qertum:<tag>
cosign verify --key qertum-release-primary.pub qertum/qertum-services:<tag>

Use the same command with quay.io/qertum/... or ghcr.io/qertum/... if you pull from there. A good result prints The signatures were verified against the specified public key and a JSON line naming the image digest. Pull by that digest (qertum/qertum@sha256:...) if you want to be sure you run exactly what was checked.

Check the release files

Download SHA256SUMS, SHA256SUMS.sigstore.json and the files you need from the GitHub release into one folder, then:

cosign verify-blob --key qertum-release-primary.pub --bundle SHA256SUMS.sigstore.json SHA256SUMS
sha256sum --check --ignore-missing SHA256SUMS

The first command proves SHA256SUMS is the file we signed (it prints Verified OK). The second proves your downloads match it (OK for each file you have). On macOS use shasum -a 256 --check --ignore-missing SHA256SUMS. On Windows, compare (Get-FileHash .\qca.exe -Algorithm SHA256).Hash with the line for qca.exe.

When a check fails

• Try qertum-release-spare.pub: the release notes say when the spare key signed a release.
• Make sure the release is 1.0.0-rc6 or later.
• Otherwise do not use the download. Report it as described in the security policy.

If a key is ever withdrawn, a GitHub security advisory and the release notes say so and name the releases it signed.