Verify the Integrity of Atlas CLI Packages
The Atlas CLI release team digitally signs all software packages and container images to certify that a particular package is valid and unaltered. Before you install the Atlas CLI packages for Linux, Windows, or Docker, you should validate the package using the provided PGP signature, SHA-256 checksum, or Cosign information.
Verify Linux Packages
MongoDB signs each release branch with a different PGP key. The public key files for the lastest Atlas CLI release is available for download from the key server.
The following procedure verifies the Atlas CLI package against its PGP key.
Download the Atlas CLI installation file.
Download the Atlas CLI binaries from the MongoDB Download Center based on your Linux environment. Click Copy link and use the URL in the following instructions.
For example, to download the 1.29.0
release
for Linux through the shell, run the following command:
curl -LO https://fastdl.mongodb.org/mongocli/mongodb-atlas-cli_1.29.0_linux_x86_64.tar.gz
Download and import the key file.
Run the following command to download and import the key file:
curl -LO https://pgp.mongodb.com/atlas-cli.asc gpg --import atlas-cli.asc
gpg: key <key-value-short>: public key "Atlas CLI Release Signing Key <packaging@mongodb.com>" imported gpg: Total number processed: 1 gpg: imported: 1
Verify the Atlas CLI installation file.
Run the following command to verify the installation file:
gpg --verify mongodb-atlas-cli_1.29.0_linux_x86_64.tar.gz.sig mongodb-atlas-cli_1.29.0_linux_x86_64.tar.gz
gpg: Signature made Thu Mar 14 08:25:00 2024 EDT gpg: using RSA key <key-value-long> gpg: Good signature from "Atlas CLI Release Signing Key <packaging@mongodb.com>" [unknown]
If the package is properly signed, but you don't currently trust
the signing key, gpg
also returns the following message :
gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner.
Verify Windows Packages
The following procedure verifies the Atlas CLI package against its SHA-256 key.
Download the Atlas CLI installation file.
Download the Atlas CLI .msi
or .zip
file from the
MongoDB Download Center or
Github.
Save the public signature.
Download the
checksums.txt
file for the release from Github, which contains the SHA-256 key for each file. For example, for version 1.29.0, download the 1.29.0 checksums.txt file.Open the
checksums.txt
file and copy the text listed to the left of the package you downloaded. For example, if you downloadedmongodb-atlas-cli_1.29.0_windows_x86_64.zip
, copy the text to the left ofmongodb-atlas-cli_1.29.0_windows_x86_64.zip
. This value is the SHA-256 key value.Save the SHA-256 key value in a
.txt
file namedatlas-cli-key
in your Downloads folder.
Compare the signature file to the Atlas CLI installer hash.
Run the Powershell command to verify the package based on the file you downloaded.
If you downloaded
mongodb-atlas-cli_1.29.0_windows_x86_64.zip
,
run the following command:
$sigHash = (Get-Content $Env:HomePath\Downloads\atlas-cli-key.txt | Out-String).SubString(0,64).ToUpper(); ` $fileHash = (Get-FileHash $Env:HomePath\Downloads\mongodb-atlas-cli_1.29.0_windows_x86_64.zip).Hash.Trim(); ` echo $sigHash; echo $fileHash; ` $sigHash -eq $fileHash
<key-value-from-signature-file> <key-value-from-downloaded-package> True
If you downloaded
mongodb-atlas-cli_1.29.0_windows_x86_64.msi
,
run the following command:
$sigHash = (Get-Content $Env:HomePath\Downloads\atlas-cli-key.txt | Out-String).SubString(0,64).ToUpper(); ` $fileHash = (Get-FileHash $Env:HomePath\Downloads\mongodb-atlas-cli_1.29.0_windows_x86_64.msi).Hash.Trim(); ` echo $sigHash; echo $fileHash; ` $sigHash -eq $fileHash
<key-value-from-signature-file> <key-value-from-downloaded-package> True
The command returns the key value from the signature file, the
key value from the downloaded package, and True
if the two
values match.
If the two values match, the Atlas CLI binary is verified.
Verify Docker Container Images
You can use Cosign to verify MongoDB's signature for Atlas CLI container images.
To verify MongoDB's container signature, perform the following steps:
Download and install Cosign.
Example: MacOS
brew install cosign
For full installation instructions, see Cosign.
Verify the signature.
Run the following command to verify the signature by tag:
COSIGN_REPOSITORY=docker.io/mongodb/signatures cosign verify --private-infrastructure --key=./atlas-cli.pem docker.io/mongodb/atlas:latest
Verification for index.docker.io/mongodb/atlas:latest -- The following checks were performed on each of these signatures: - The cosign claims were validated - The signatures were verified against the specified public key [{"critical":{"identity":{"docker-reference":"index.docker.io/mongodb/atlas"},"image":{"docker-manifest-digest":"sha256:<key-value>"},"type":"cosign container image signature"},"optional":null}]