Newer
Older
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
DETAILS:
**Tier:** Free, Premium, Ultimate
**Offering:** Self-managed
We use a [packagecloud](https://packagecloud.io) instance at <https://packages.gitlab.com> to share the
different OS packages we offer.
The instance uses various cryptographic methods to ensure the integrity of these packages.
## Package repository metadata signing keys
The APT and YUM repositories on the packagecloud instance use a GPG key to
sign their metadata. This key is automatically installed by the repository setup
script specified in the installation instructions.
| Key attribute | Value |
|:--------------|:------|
| Name | `GitLab B.V.` |
| EMail | `packages@gitlab.com` |
| Comment | `package repository signing key` |
| Fingerprint | `F640 3F65 44A3 8863 DAA0 B6E0 3F01 618A 5131 2F3F` |
| Expiry | `2026-02-27` |
This key is active from **2020-04-06**.
The key's expiry was extended from **2024-03-01** to **2026-02-27**. If you encounter an expiration of `2024-03-01`,
follow the instructions below.
::Tabs
packagecloud made used `apt-key`, which [is deprecated](https://blog.packagecloud.io/secure-solutions-for-apt-key-add-deprecated-messages/)
. Manually installed or configured repositories from some distributions, such as [TurnKey Linux](https://www.turnkeylinux.org/),
are already using the `signed-by` support in Debian package source lists.
1. Determine if you're using `apt-key` or `signed-by`:
```shell
grep 'deb \[signed-by=' /etc/apt/sources.list.d/gitlab_gitlab-?e.list
```
- Returns any lines, you're using `signed-by`, which takes precedence over `apt-key`.
- No lines, you're using `apt-key`.
1. If using `signed-by`, run this script as root to update the public keys for GitLab repositories:
```shell
awk '/deb \[signed-by=/{
pubkey = $2;
sub(/\[signed-by=/, "", pubkey);
sub(/\]$/, "", pubkey);
print pubkey
}' /etc/apt/sources.list.d/gitlab_gitlab-?e.list | \
while read line; do
curl -s "https://packages.gitlab.com/gpg.key" | gpg --dearmor > $line
done
```
1. If using `apt-key`, run this script as root to update the public keys for GitLab repositories:
```shell
apt-key del 3F01618A51312F3F
curl -s "https://packages.gitlab.com/gpg.key" | apt-key add -
apt-key list 3F01618A51312F3F
```
YUM and DNF have small differences, but the underlying configuration is identical:
1. Remove any existing key from the repository keyrings:
```shell
for pubring in /var/cache/dnf/*gitlab*/pubring
do
gpg --homedir $pubring --delete-key F6403F6544A38863DAA0B6E03F01618A51312F3F
done
```
1. Update the repository data and cache, which asks you to confirm keys:
```shell
dnf check-update
```
::EndTabs
### Fetch latest signing key
To fetch the latest repository signing key:
```shell
curl "https://packages.gitlab.com/gpg.key" -o /tmp/omnibus_gitlab_gpg.key
```
::Tabs
:::TabTitle Debian/Ubuntu/Raspbian
```shell
sudo apt-key add /tmp/omnibus_gitlab_gpg.key
```
:::TabTitle CentOS/OpenSUSE/SLES
```shell
sudo rpm --import /tmp/omnibus_gitlab_gpg.key
```
1. Make sure that the new key has the necessary permissions to be properly recognized by your OS, which should be `644`.
You can set the permissions by running:
| Sl. No. | Key ID | Expiry date |
|:--------|:-----------------------------------------------------|:------------|
| 1 | `1A4C 919D B987 D435 9396 38B9 1421 9A96 E15E 78F4` | `2020-04-15` |
This section provides methods for verifying the signatures of GitLab-produced packages, both manually and automatically
The RPM format contains a full implementation of GPG signing functionality and is fully integrated with the package
management systems based upon that format.
#### Verify GitLab public key is present
To verify a package on an RPM based distribution, ensure that the GitLab, Inc. public key is present in the `rpm`
keychain. For example:
```shell
rpm -q gpg-pubkey-f27eab47-60d4a67e --qf '%{name}-%{version}-%{release} --> %{summary}'
```
This command produces either:
- Information on the public key.
- A message that the key isn't installed. For example: `gpg-pubkey-f27eab47-60d4a67e is not installed`.
If the key is not present, import it. For example:
rpm --import https://packages.gitlab.com/gitlab/gitlab-ce/gpgkey/gitlab-gitlab-ce-3D645A26AB9FBD22.pub.gpg
#### Verify if signature check is active
To check if package signature checking is active on an existing install, compare the content of the repository file:
1. Check if the repository file exist: `file /etc/yum.repos.d/gitlab_gitlab-ce.repo`.
1. Check that signature checking is active: `grep gpgcheck /etc/yum.repos.d/gitlab_gitlab-ce.repo`. This command should
output:
If the file does not exist, you don't have the repository installed. If the file exists, but the output shows
`gpgpcheck=0`, then you must edit that value to enable it.
After confirming that the public key is present, verify the package:
The Debian package format does not officially contain a method for signing packages. We implemented the `debsig`
standard, which is well documented but not enabled by default on most distributions.
You can verify Linux package `deb` file by either:
- Using `debsig-verify` after configuring the necessary `debsigs` policy and keyring.
- Manually checking the contained `_gpgorigin` file with GnuPG.
Because configuring a policy and keyring for `debsigs` can be complicated, we provide the `gitlab-debsigs.sh` script
for configuration. To use this script, you need to download the public key and the script.
curl -JLO "https://packages.gitlab.com/gitlab/gitlab-ce/gpgkey/gitlab-gitlab-ce-3D645A26AB9FBD22.pub.gpg"
curl -JLO "https://gitlab.com/gitlab-org/omnibus-gitlab/raw/master/scripts/gitlab-debsigs.sh"
sudo ./gitlab-debsigs.sh gitlab-gitlab-ce-3D645A26AB9FBD22.pub.gpg
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
#### Verify with `debsig-verify`
To use of `debsig-verify`:
1. [Configure `debsigs`](#configure-debsigs).
1. Install the `debsig-verify` package.
1. Run `debsig-verify` to verify the file:
```shell
debsig-verify gitlab-xxx.deb
```
#### Verify with GnuPG
If you don't want to install dependencies installed by `debsig-verify`, you can use GnuPG instead:
1. Download and import the package signing public key:
```shell
curl -JLO "https://packages.gitlab.com/gitlab/gitlab-ee/gpgkey/gitlab-gitlab-ee-3D645A26AB9FBD22.pub.gpg"
gpg --import gitlab-gitlab-ee-3D645A26AB9FBD22.pub.gpg
```
1. Extract the signature file `_gpgorigin`:
```shell
ar x gitlab-xxx.deb _gpgorigin
```
1. Verify the signature matches the content:
```shell
ar p gitlab-xxx.deb debian-binary control.tar.gz data.tar.gz | gpg --verify _gpgorigin -
```
The output of this command should appear like this:
```shell
gpg: Signature made Tue Aug 01 22:21:11 2017 UTC
gpg: using RSA key DBEF89774DDB9EB37D9FC3A03CFCF9BAF27EAB47
gpg: issuer "support@gitlab.com"
gpg: Good signature from "GitLab, Inc. <support@gitlab.com>" [unknown]
Primary key fingerprint: DBEF 8977 4DDB 9EB3 7D9F C3A0 3CFC F9BA F27E AB47
```
If the verification fails with `gpg: BAD signature from "GitLab, Inc. <support@gitlab.com>" [unknown]`, ensure:
- The file names are written in correct order.
- The file names match the content of the archive.
Depending on what Linux distribution you use, the content of the archive might have a different suffix. This means you
need to adjust the command accordingly. To confirm the content of the archive, run `ar t gitlab-xxx.deb`.
For example, for Ubuntu Focal (20.04):
```shell
$ ar t gitlab-ee_17.4.2-ee.0_amd64.deb
debian-binary
control.tar.xz
data.tar.xz
_gpgorigin
```