Verify a download
Antelao signs both Blocklist images: the API, ghcr.io/antelao-io/blocklist, and the console,
ghcr.io/antelao-io/blocklist-ui. This page shows how to check them before you deploy them.
Every check here runs on any Linux machine; it does not have to be the host.
The public key
Every Antelao image and script is signed with one key pair. Its public half is published at:
https://packages.antelao.io/raw/cosign.pub
Download it and compare its SHA-256 with the one on this page:
curl -fsSLO https://packages.antelao.io/raw/cosign.pub
sha256sum cosign.pub
The output must read:
b485d68100a0e9213130796831efcca16bc445bfcf0375299262a2428581cdb4 cosign.pub
Keep the file: every command below reads it from the current directory.
Install cosign
The checks use cosign, version 2 or later, from the Sigstore project. Install it as the Sigstore documentation describes, then check that it runs:
cosign version
An image
Check an image by the release number you deploy, the one your compose file names, in place of <release>:
cosign verify --key cosign.pub --insecure-ignore-tlog=true \
-a io.antelao.version=<release> \
ghcr.io/antelao-io/blocklist:<release>
A good signature prints the checks cosign made, among them "The signatures were verified against the specified public key", followed by the signature's details, including the image's digest. Anything else is a failure.
-a io.antelao.version=<release> is optional, and worth keeping: every image is
signed with its release number attached, so this also proves the signature was made for the release
you asked for and not for another one.
The console's image is checked with the same command: change blocklist to blocklist-ui. Both images carry the same release number, BLOCKLIST_VERSION in the compose file.
Antelao signs with its own key and does not record its signatures in a public transparency log, so cosign is told not to look for an entry there. The signature itself is still checked against the key. cosign prints a warning about the option; that warning is expected.
When a check fails
Do not install or run what failed. A failed check means the file or the image is not the one Antelao published, or was changed on the way.
- Delete what you downloaded, including
cosign.pub. - Download it again from the addresses on this page, and check the key's SHA-256 first.
- If it still fails, stop and contact Antelao support with the command you ran and its full output.