Ctrlk
Sign UpGet a DemoContact Us
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Code signing

Traceable publishes many artifacts that run in your environment, such as docker images, archives, installers, and helm charts. To make sure that you are running the right and secure artifacts, Traceable provides you with an option to check the authenticity of such artifacts. The steps detailed in this topic are optional, and you should use them only when you wish to check the authenticity of artifacts.

Traceable provides the option to check the following artifacts:

  • JAR

  • Archive or any arbitrary file types

  • Debian package

  • RPM package

  • Docker image

  • Terraform archives

  • Helm charts

GPG key

Traceable provides a GPG public key that is available at https://packages.traceable.ai/public-key.asc. You can use the GPG public key to verify JARs, Debian distributions(apt, deb), rpm for centos7/8.

Signing JARs

Traceable signs and publishes maven jar, which is signed via the Gradle Publish plugin. The Maven central server makes it mandatory to upload only signed JARs. The public key is available in key servers: keyserver.ubuntu.com, keys.openpgp.org, pgp.mit.edu.

Archive checksum verification

Signing

With each archive, Traceable uploads its signature, for example:

Archive-name — traceable-cli-1.8.7-macosx-x86_64.tar.gz

Signature — traceable-cli-1.8.7-macosx-x86_64.tar.gz.sig

Note that it has the same path and name as the .tar.gz file it corresponds to but has the extension .sig

Following is a typical command to create a detached signature interactively:

Verification

Download and install the gpg command using your package manager. For more information about GnuPG, see the GnuPG website.

Import the Traceable AI GPG public key with the following commands:

Download the signature file for the package you downloaded. It has the same path and name as the package it corresponds to but has the extension .sig . For example:

Verify the signature by providing both the downloaded .sig and package names as parameters to the gpg command as shown below:

The output should look similar to the following:

The warning in the output is expected and doesn't indicate a problem. It occurs because there is a chain of trust missing between your personal PGP key (if you have one) and the Traceable AI PGP key. For more information, see Web of trust.

Linux package checksum verification

Traceable’s Linux repositories and packages are signed with the same GPG key. Follow the same procedure of key import as described in Releases Archive Checksum Verification.

Debian/Ubuntu

Verification

.deb binaries

The Debian packages are signed using debsigs. You will need to install the program debsig-verify to verify the packages. Complete the following steps:

  1. Install debsigs. Enter the following command:

  2. Download Traceable’s public key. Enter the following command:

  3. Create directories to store debsigs policies and keyrings for Traceable’s public key. Enter the following command:

  4. Initialize an empty keyring. Enter the following command:

  5. Import Slack’s public key into the corresponding debsigs keyring. Enter the following command:

  6. Create a new file in your editor of choice. Enter the following command:

  7. Paste the following in the file that you created in the previous step. Save the file and exit the editor.

  8. Check the package signature. Enter the following command:

The output should be similar:

APT

For all existing users, if the following changes are not done or yet to be done, they will see:

To avoid the above problem and start verifying traceable apt repo, set the repository using the following:

Install the Debian artifacts using the following sources.list, so that apt can only install verified packages.

Update apt again and install Traceable:

Red Hat/CentOS/Amazon Linux 2

.rpm binaries

On RedHat-based Linux systems, validation is built into the rpm command; however, rpm does not use the GnuPG key store, so you first need to import the public key.

You can validate the signature as follows:

yum

If you are installing the packages using yum, it uses configuration files in /etc/yum.repos.d to specify a URL for the GPG key used to verify packages in that repository. If the key is not already available for verification, the utilities can import it.

Create a file named /etc/yum.repos.d/traceable.repo with the following content:

Make sure to change the base to match your OS. Replace [7|8] with the version of CentOS you are using. Execute rpm -E %{rhel} to fetch the CentOS version.

Install Traceable

Enter the following command:

Docker image signing validation

This section describes how to use Cosign to validate the provenance of Traceable’s image artifacts.

Cosign is a tool developed as part of the sigstore project. It simplifies signing and validating signed Open Container Initiative (OCI) artifacts, such as container images.

We sign all officially published container images as part of our release process. End users can then verify these images using the process described below.

This process is suitable for either manual execution or integration with build or deployment pipelines to automate artifact verification.

Before you begin

Complete the following steps:

  1. Download the latest Cosign build for your architecture, as well as its signature.

  2. Validate the cosign binary signature:

  3. Make the binary executable (chmod +x) and move to a location on the PATH

Validating image

To validate a container image, do the following:

This process will work for any released image or release candidate built with the Traceable’s build infrastructure.

Following is an example with output:

Helm charts provenance

Traceable’s helm charts are signed using the same PGP key shared above. Import the Public PGP key using the following method:

Alternatively, you may download and import Traceable’s public key from the Ubuntu keyserver with a command like this:

Verification

Integrity is established by comparing a chart to a provenance record. Provenance records are stored in provenance files, which are stored alongside a packaged chart. For example, if a chart is named traceable-agent-1.42.1.tgz, its provenance file will be traceable-agent-1.42.1.tgz.prov

Provenance files are generated at packaging time (helm package --sign ...) and pushed to our chart repository, which can be checked by multiple commands (The following steps assume you have the public key in binary format in ~/.gnupg/pubring.gpg).

The verification phase can also be integrated into the regular Helm commands we used so far. For example, to verify when we download a chart from the Internet or when installing a chart, we add the --verify parameter to the commands:

Failed verification

If the signature verification fails, the installation phase is abandoned. In such a case, do not install charts you do not trust.

A failed verification may look like this:

Or if the chart is unsigned/Provenance file is missing:

For more information, see Helm | Helm Provenance and Integrity.

Terraform modules checksum verification

Traceable’s terraform modules are signed the same way as any other archive provided by Traceable. Follow Releases Archive Checksum Signing & Verification **** instructions to sign and check integrity of the terraform modules.

Windows artifacts signing verification

The best way to verify if a Windows artifact is signed is via UI: right-click on the artifact and select the properties option. If the artifact is signed, there will be a digital signature tab in the properties dialog box. Check if the name of the signer is Traceable Inc.

In case you want to verify via command line tools, you can do so using Powershell.

PreviousOptional installation topics
NextAgent ports

Last updated

Was this helpful?