Verify a download
Antelao signs what it publishes: the container images the Odoo Host Manager runs, and the scripts you download and run on a host. The apt repository is signed with a key of its own. This page shows how to check each of them before you install anything.
Every check here runs on any Linux machine; it does not have to be the server.
The public key
Every Antelao image and script is signed with one key pair. Its public half is published at:
https://packages.antelao.io/raw/cosign.pub
Download it and compare its SHA-256 with the one on this page:
curl -fsSLO https://packages.antelao.io/raw/cosign.pub
sha256sum cosign.pub
The output must read:
b485d68100a0e9213130796831efcca16bc445bfcf0375299262a2428581cdb4 cosign.pub
Keep the file: every command below reads it from the current directory.
Install cosign
The checks use cosign, version 2 or later, from the Sigstore project. Install it as the Sigstore documentation describes, then check that it runs:
cosign version
An image
Check an image by the release number you deploy, here 0.25.0:
cosign verify --key cosign.pub --insecure-ignore-tlog=true \
-a io.antelao.version=0.25.0 \
ghcr.io/antelao-io/ohm-api:0.25.0
A good signature prints the checks cosign made, among them "The signatures were verified against the specified public key", followed by the signature's details, including the image's digest. Anything else is a failure.
-a io.antelao.version=0.25.0 is optional, and worth keeping: every image is
signed with its release number attached, so this also proves the signature was made for the release
you asked for and not for another one.
The same command checks every image of a server's stack. Change the name, and the release number to the one that image carries:
| What | Images |
|---|---|
| The Odoo Host Manager | ghcr.io/antelao-io/ohm-api, ohm-web, ohm-agent |
| The GeoIP service in its stack | ghcr.io/antelao-io/geoip |
| The Fail2Ban service in its stack | ghcr.io/antelao-io/fail2ban |
Antelao signs with its own key and does not record its signatures in a public transparency log, so cosign is told not to look for an entry there. The signature itself is still checked against the key. cosign prints a warning about the option; that warning is expected.
A script
Every script you download from https://packages.antelao.io/raw/ has its signature beside it, under
the same name with .sig added. Download both, check, and only then run the script. For the
installer, this replaces the one-line curl ... | sudo bash:
curl -fsSLO https://packages.antelao.io/raw/antelao-ohm-installer.sh
curl -fsSLO https://packages.antelao.io/raw/antelao-ohm-installer.sh.sig
cosign verify-blob --key cosign.pub --signature antelao-ohm-installer.sh.sig \
--insecure-ignore-tlog=true antelao-ohm-installer.sh
A good signature prints Verified OK. cosign 3 also says that --signature is deprecated; the check
is the same and still passes. Then run the file you just checked:
sudo bash antelao-ohm-installer.sh
The UFW ruleset from Restricting the management ports is checked the same way:
curl -fsSLO https://packages.antelao.io/raw/antelao-ohm-ufw.sh
curl -fsSLO https://packages.antelao.io/raw/antelao-ohm-ufw.sh.sig
cosign verify-blob --key cosign.pub --signature antelao-ohm-ufw.sh.sig \
--insecure-ignore-tlog=true antelao-ohm-ufw.sh
The apt repository
The apt repository that carries the antelao-ohm package is signed with an OpenPGP key, and apt
checks every package against it by itself. What is yours to check is the key, once, when you add it.
Its full fingerprint is:
9BCA9361422F68BE90FC438D6AF95B6FF57CCE21
Download the key file and show it without importing it:
curl -fsSL https://packages.antelao.io/raw/pgp/6AF95B6FF57CCE21.asc -o antelao.asc
gpg --show-keys antelao.asc
The line under pub must read 9BCA9361422F68BE90FC438D6AF95B6FF57CCE21. The installer adds this
same key; to add it by hand on your own machine, see
Administering it from your own machine.
When a check fails
Do not install or run what failed. A failed check means the file or the image is not the one Antelao published, or was changed on the way.
- Delete what you downloaded, including
cosign.pub. - Download it again from the addresses on this page, and check the key's SHA-256 first.
- If it still fails, stop and contact Antelao support with the command you ran and its full output.