git.squeep.com Git - akkoma/blob - docs/docs/installation/verifying_otp_releases.md

   1 # Verifying OTP release integrity
   2
   3 All stable OTP releases are cryptographically signed, to allow
   4 you to verify the integrity if you choose to.
   5
   6 Releases are signed with [Signify](https://man.openbsd.org/signify.1),
   7 with [the public key in the main repository](https://akkoma.dev/AkkomaGang/akkoma/src/branch/stable/SIGNING_KEY.pub)
   8
   9 Release URLs will always be of the form
  10
  11 ```
  12 https://akkoma-updates.s3-website.fr-par.scw.cloud/{branch}/akkoma-{flavour}.zip
  13 ```
  14
  15 Where branch is usually `stable` or `develop`, and `flavour` is
  16 the one [that you detect on install](../otp_en/#detecting-flavour).
  17
  18 So, for an AMD64 stable install, your update URL will be
  19
  20 ```
  21 https://akkoma-updates.s3-website.fr-par.scw.cloud/stable/akkoma-amd64.zip
  22 ```
  23
  24 To verify the integrity of this file, we have two helper files
  25
  26 ```
  27 # Checksums
  28 https://akkoma-updates.s3-website.fr-par.scw.cloud/{branch}/akkoma-{flavour}.zip.sha256
  29
  30 # Signify signature of the hashes
  31 https://akkoma-updates.s3-website.fr-par.scw.cloud/{branch}/akkoma-{flavour}.zip.sha256.sig
  32 ```
  33
  34 Thus, to upgrade manually, with integrity checking, consider the following script:
  35
  36 ```bash
  37 #!/bin/bash
  38 set -eo pipefail
  39
  40 export FLAVOUR=amd64
  41 export BRANCH=stable
  42
  43 # Fetch signing key
  44 curl --silent https://akkoma.dev/AkkomaGang/akkoma/raw/branch/$BRANCH/SIGNING_KEY.pub -o AKKOMA_SIGNING_KEY.pub
  45
  46 # Download zip file and sig files
  47 wget -q https://akkoma-updates.s3-website.fr-par.scw.cloud/$BRANCH/akkoma-$FLAVOUR{.zip,.zip.sha256,.zip.sha256.sig}
  48
  49 # Verify zip file's sha256 integrity
  50 sha256sum --check akkoma-$FLAVOUR.zip.sha256
  51
  52 # Verify hash file's integrity
  53 # Signify might be under the `signify` command, depending on your distribution
  54 signify-openbsd -V -p AKKOMA_SIGNING_KEY.pub -m akkoma-$FLAVOUR.zip.sha256
  55
  56 # We're good, use that URL
  57 echo "Update URL contents verified"
  58 echo "use"
  59 echo "./bin/pleroma_ctl update --zip-url https://akkoma-updates.s3-website.fr-par.scw.cloud/$BRANCH/akkoma-$FLAVOUR"
  60 echo "to update your instance"
  61
  62 # Clean up
  63 rm akkoma-$FLAVOUR.zip
  64 rm akkoma-$FLAVOUR.zip.sha256
  65 rm akkoma-$FLAVOUR.zip.sha256.sig
  66 ```