Skip to main content

Verify a download

Antelao signs both Fail2Ban images: the API, ghcr.io/antelao-io/fail2ban, and the console, ghcr.io/antelao-io/fail2ban-ui. This page shows how to check them before you deploy them.

Every check here runs on any Linux machine; it does not have to be the host.

The public key​

Every Antelao image and script is signed with one key pair. Its public half is published at:

https://packages.antelao.io/raw/cosign.pub

Download it and compare its SHA-256 with the one on this page:

curl -fsSLO https://packages.antelao.io/raw/cosign.pub
sha256sum cosign.pub

The output must read:

b485d68100a0e9213130796831efcca16bc445bfcf0375299262a2428581cdb4  cosign.pub

Keep the file: every command below reads it from the current directory.

Install cosign​

The checks use cosign, version 2 or later, from the Sigstore project. Install it as the Sigstore documentation describes, then check that it runs:

cosign version

An image​

Check an image by the release number you deploy, here 1.5.1:

cosign verify --key cosign.pub --insecure-ignore-tlog=true \
-a io.antelao.version=1.5.1 \
ghcr.io/antelao-io/fail2ban:1.5.1

A good signature prints the checks cosign made, among them "The signatures were verified against the specified public key", followed by the signature's details, including the image's digest. Anything else is a failure.

-a io.antelao.version=1.5.1 is optional, and worth keeping: every image is signed with its release number attached, so this also proves the signature was made for the release you asked for and not for another one.

The console's image is checked with the same command: change fail2ban to fail2ban-ui. Both images carry the same release number.

Why --insecure-ignore-tlog=true

Antelao signs with its own key and does not record its signatures in a public transparency log, so cosign is told not to look for an entry there. The signature itself is still checked against the key. cosign prints a warning about the option; that warning is expected.

When a check fails​

Do not install or run what failed. A failed check means the file or the image is not the one Antelao published, or was changed on the way.

  1. Delete what you downloaded, including cosign.pub.
  2. Download it again from the addresses on this page, and check the key's SHA-256 first.
  3. If it still fails, stop and contact Antelao support with the command you ran and its full output.
Last updated on