--- stage: Systems group: Distribution info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments --- # Linux package signatures DETAILS: **Tier:** Free, Premium, Ultimate **Offering:** Self-managed We use a [packagecloud](https://packagecloud.io) instance at <https://packages.gitlab.com> to share the different OS packages we offer. The instance uses various cryptographic methods to ensure the integrity of these packages. ## Package repository metadata signing keys The APT and YUM repositories on the packagecloud instance use a GPG key to sign their metadata. This key is automatically installed by the repository setup script specified in the installation instructions. ### Current signing key | Key attribute | Value | |:--------------|:------| | Name | `GitLab B.V.` | | EMail | `packages@gitlab.com` | | Comment | `package repository signing key` | | Fingerprint | `F640 3F65 44A3 8863 DAA0 B6E0 3F01 618A 5131 2F3F` | | Expiry | `2026-02-27` | This key is active from **2020-04-06**. The key's expiry was extended from **2024-03-01** to **2026-02-27**. If you encounter an expiration of `2024-03-01`, follow the instructions below. ::Tabs :::TabTitle Debian-based distributions packagecloud made used `apt-key`, which [is deprecated](https://blog.packagecloud.io/secure-solutions-for-apt-key-add-deprecated-messages/) . Manually installed or configured repositories from some distributions, such as [TurnKey Linux](https://www.turnkeylinux.org/), are already using the `signed-by` support in Debian package source lists. 1. Determine if you're using `apt-key` or `signed-by`: ```shell grep 'deb \[signed-by=' /etc/apt/sources.list.d/gitlab_gitlab-?e.list ``` If this command: - Returns any lines, you're using `signed-by`, which takes precedence over `apt-key`. - No lines, you're using `apt-key`. 1. If using `signed-by`, run this script as root to update the public keys for GitLab repositories: ```shell awk '/deb \[signed-by=/{ pubkey = $2; sub(/\[signed-by=/, "", pubkey); sub(/\]$/, "", pubkey); print pubkey }' /etc/apt/sources.list.d/gitlab_gitlab-?e.list | \ while read line; do curl -s "https://packages.gitlab.com/gpg.key" | gpg --dearmor > $line done ``` 1. If using `apt-key`, run this script as root to update the public keys for GitLab repositories: ```shell apt-key del 3F01618A51312F3F curl -s "https://packages.gitlab.com/gpg.key" | apt-key add - apt-key list 3F01618A51312F3F ``` :::TabTitle RPM-based distributions YUM and DNF have small differences, but the underlying configuration is identical: 1. Remove any existing key from the repository keyrings: ```shell for pubring in /var/cache/dnf/*gitlab*/pubring do gpg --homedir $pubring --delete-key F6403F6544A38863DAA0B6E03F01618A51312F3F done ``` 1. Update the repository data and cache, which asks you to confirm keys: ```shell dnf check-update ``` ::EndTabs ### Fetch latest signing key To fetch the latest repository signing key: 1. Download the key: ```shell curl "https://packages.gitlab.com/gpg.key" -o /tmp/omnibus_gitlab_gpg.key ``` 1. Import the key: ::Tabs :::TabTitle Debian/Ubuntu/Raspbian ```shell sudo apt-key add /tmp/omnibus_gitlab_gpg.key ``` :::TabTitle CentOS/OpenSUSE/SLES ```shell sudo rpm --import /tmp/omnibus_gitlab_gpg.key ``` ::EndTabs 1. Make sure that the new key has the necessary permissions to be properly recognized by your OS, which should be `644`. You can set the permissions by running: ```shell chmod 644 <keyfile> ``` ### Previous key | Sl. No. | Key ID | Expiry date | |:--------|:-----------------------------------------------------|:------------| | 1 | `1A4C 919D B987 D435 9396 38B9 1421 9A96 E15E 78F4` | `2020-04-15` | ## Package signatures This section provides methods for verifying the signatures of GitLab-produced packages, both manually and automatically where supported. ### RPM-based distributions The RPM format contains a full implementation of GPG signing functionality and is fully integrated with the package management systems based upon that format. #### Verify GitLab public key is present To verify a package on an RPM based distribution, ensure that the GitLab, Inc. public key is present in the `rpm` keychain. For example: ```shell rpm -q gpg-pubkey-f27eab47-60d4a67e --qf '%{name}-%{version}-%{release} --> %{summary}' ``` This command produces either: - Information on the public key. - A message that the key isn't installed. For example: `gpg-pubkey-f27eab47-60d4a67e is not installed`. If the key is not present, import it. For example: ```shell rpm --import https://packages.gitlab.com/gitlab/gitlab-ce/gpgkey/gitlab-gitlab-ce-3D645A26AB9FBD22.pub.gpg ``` #### Verify if signature check is active To check if package signature checking is active on an existing install, compare the content of the repository file: 1. Check if the repository file exist: `file /etc/yum.repos.d/gitlab_gitlab-ce.repo`. 1. Check that signature checking is active: `grep gpgcheck /etc/yum.repos.d/gitlab_gitlab-ce.repo`. This command should output: ```plaintext repo_gpgcheck=1 gpgcheck=1 ``` or ```plaintext repo_gpgcheck=1 pkg_gpgcheck=1 ``` If the file does not exist, you don't have the repository installed. If the file exists, but the output shows `gpgpcheck=0`, then you must edit that value to enable it. #### Verify a Linux package `rpm` file After confirming that the public key is present, verify the package: ```shell rpm --checksig gitlab-xxx.rpm ``` ### Debian-based distributions The Debian package format does not officially contain a method for signing packages. We implemented the `debsig` standard, which is well documented but not enabled by default on most distributions. You can verify Linux package `deb` file by either: - Using `debsig-verify` after configuring the necessary `debsigs` policy and keyring. - Manually checking the contained `_gpgorigin` file with GnuPG. #### Configure `debsigs` Because configuring a policy and keyring for `debsigs` can be complicated, we provide the `gitlab-debsigs.sh` script for configuration. To use this script, you need to download the public key and the script. ```shell curl -JLO "https://packages.gitlab.com/gitlab/gitlab-ce/gpgkey/gitlab-gitlab-ce-3D645A26AB9FBD22.pub.gpg" curl -JLO "https://gitlab.com/gitlab-org/omnibus-gitlab/raw/master/scripts/gitlab-debsigs.sh" chmod +x gitlab-debsigs.sh sudo ./gitlab-debsigs.sh gitlab-gitlab-ce-3D645A26AB9FBD22.pub.gpg ``` #### Verify with `debsig-verify` To use of `debsig-verify`: 1. [Configure `debsigs`](#configure-debsigs). 1. Install the `debsig-verify` package. 1. Run `debsig-verify` to verify the file: ```shell debsig-verify gitlab-xxx.deb ``` #### Verify with GnuPG If you don't want to install dependencies installed by `debsig-verify`, you can use GnuPG instead: 1. Download and import the package signing public key: ```shell curl -JLO "https://packages.gitlab.com/gitlab/gitlab-ee/gpgkey/gitlab-gitlab-ee-3D645A26AB9FBD22.pub.gpg" gpg --import gitlab-gitlab-ee-3D645A26AB9FBD22.pub.gpg ``` 1. Extract the signature file `_gpgorigin`: ```shell ar x gitlab-xxx.deb _gpgorigin ``` 1. Verify the signature matches the content: ```shell ar p gitlab-xxx.deb debian-binary control.tar.gz data.tar.gz | gpg --verify _gpgorigin - ``` The output of this command should appear like this: ```shell gpg: Signature made Tue Aug 01 22:21:11 2017 UTC gpg: using RSA key DBEF89774DDB9EB37D9FC3A03CFCF9BAF27EAB47 gpg: issuer "support@gitlab.com" gpg: Good signature from "GitLab, Inc. <support@gitlab.com>" [unknown] Primary key fingerprint: DBEF 8977 4DDB 9EB3 7D9F C3A0 3CFC F9BA F27E AB47 ``` If the verification fails with `gpg: BAD signature from "GitLab, Inc. <support@gitlab.com>" [unknown]`, ensure: - The file names are written in correct order. - The file names match the content of the archive. Depending on what Linux distribution you use, the content of the archive might have a different suffix. This means you need to adjust the command accordingly. To confirm the content of the archive, run `ar t gitlab-xxx.deb`. For example, for Ubuntu Focal (20.04): ```shell $ ar t gitlab-ee_17.4.2-ee.0_amd64.deb debian-binary control.tar.xz data.tar.xz _gpgorigin ```