☰

如何验证centos 8的校验和文件？

tag-icon • tag-icon linux centos gpg checksum
如何验证centos 8的校验和文件？

如何验证 CentOS 8 ISO 的 CHECKSUM 文件是否真实？

下载校验和和密钥：

$ wget https://www.centos.org/keys/RPM-GPG-KEY-CentOS-Official
$ wget http://www.gtlib.gatech.edu/pub/centos/8.0.1905/isos/x86_64/CHECKSUM
$ wget http://www.gtlib.gatech.edu/pub/centos/8.0.1905/isos/x86_64/CHECKSUM.asc

验证密钥：

$ gpg RPM-GPG-KEY-CentOS-Official 

gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa4096 2019-05-03 [SC]
      99DB70FAE1D7CE227FB6488205B555B38483C65D
uid           CentOS (CentOS Official Signing Key) <[email protected]>

Assert that the fingerprint matches https://www.centos.org/keys/

导入密钥：

$ gpg --import RPM-GPG-KEY-CentOS-Official
gpg: key 05B555B38483C65D: public key "CentOS (CentOS Official Signing Key) <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1

无法验证 CHECKSUM 文件：

$ gpg --verify CHECKSUM.asc

gpg: Signature made Mon 23 Sep 2019 07:24:37 AM EDT
gpg:                using RSA key 05B555B38483C65D
gpg: Good signature from "CentOS (CentOS Official Signing Key) <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 99DB 70FA E1D7 CE22 7FB6  4882 05B5 55B3 8483 C65D
gpg: WARNING: not a detached signature; file 'CHECKSUM' was NOT verified!

它说：

 gpg: WARNING: not a detached signature; file 'CHECKSUM' was NOT verified!

答案1

您不需要同时使用CHECKSUM和CHECKSUM.asc。后者是 GPG 签名版本的CHECKSUM. GPG 很困惑，因为它假设如果您有somefilename和somefilename.asc，则该.asc文件是一个分离的签名。

如果你删除该文件CHECKSUM，那么你可以gpg --verify CHECKSUM.asc得到：

gpg: Signature made Mon 23 Sep 2019 07:24:37 AM EDT
gpg:                using RSA key 0x05B555B38483C65D
gpg: Good signature from "CentOS (CentOS Official Signing Key) <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 99DB 70FA E1D7 CE22 7FB6  4882 05B5 55B3 8483 C65D

答案2

这里在fedora 34工作站（主机）上没有问题。

[chris@f34 verify-centos]$ ll
total 741388
-rw-r--r--. 1 chris chris 759169024 Jun  5 11:46 CentOS-Stream-8-x86_64-20210603-boot.iso
-rw-r--r--. 1 chris chris       355 Jun  5 15:15 CHECKSUM
-rw-r--r--. 1 chris chris       811 Jun  5 15:17 CHECKSUM.asc
-rw-r--r--. 1 chris chris      1683 Jun  5 17:30 RPM-GPG-KEY-CentOS-Official
[chris@f34 verify-centos]$

请记住，像 CHECKSUM.asc 这样的 pgp 签名文件是由另一个文件生成的。我想 Centos 团队的流程大致如下。

sha256sum CentOS-Stream-8-x86_64-20210603-boot.img > CHECKSUM

gpg --sign --armor CHECKSUM

上述命令生成文件CHECKSUM和CHECKSUM.asc.

这页面有一个有用的指南，验证 Fedora 图像

验证步骤：

首先你需要导入密钥，单击下载链接，然后按 CTRL + 保存。

在此输入图像描述

然后导入。

gpg --import RPM-GPG-KEY-CentOS-Official

然后验证CHECKSUM文件是否有效，这里需要以下两个文件

  • 校验和
  • 校验和.asc

使用以下命令进行验证

gpg --verify CHECKSUM.asc

[chris@f34 verify-centos]$ gpg --verify CHECKSUM.asc 
gpg: assuming signed data in 'CHECKSUM'
gpg: Signature made Thu 03 Jun 2021 01:58:15 AM -05
gpg:                using RSA key 05B555B38483C65D
gpg: Good signature from "CentOS (CentOS Official Signing Key) <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 99DB 70FA E1D7 CE22 7FB6  4882 05B5 55B3 8483 C65D
[chris@f34 verify-centos]$

重要的一行是This

gpg: Good signature from "CentOS (CentOS Official Signing Key) <[email protected]>" [unknown]

一切都好。

现在和最后

验证下载的 Centos 镜像文件的哈希值与文件内的哈希值是否匹配CHECKSUM。请记住，该CHECKSUM文件可以包含不同版本的多个哈希值，在这种情况下有 2 个版本

在此输入图像描述

您可以通过多种方式做到这一点。

第一种方式：

运行以下命令。

sha256sum CentOS-Stream-8-x86_64-20210603-boot.iso

[chris@f34 verify-centos]$ sha256sum CentOS-Stream-8-x86_64-20210603-boot.iso 
6d957521b4488fc44bb80bdcb618bc1cf9891a997fdbd94e22424c14a356cf09  CentOS-Stream-8-x86_64-20210603-boot.iso
[chris@f34 verify-centos]$

并将该哈希值6d957521b4488fc44bb80bdcb618bc1cf9891a997fdbd94e22424c14a356cf09与图像对应行中的CHECKSUM文件中的哈希值进行比较，哈希值必须彼此匹配。

在此输入图像描述

正如您所看到的，哈希值匹配。

第二种方式：

运行以下命令。选择 CHECKSUM 文件副本中的哈希值并在grep命令后粘贴到此处。

sha256sum CentOS-Stream-8-x86_64-20210603-boot.iso | grep paste-here-the-hash-number

在此输入图像描述

如果颜色是红色则一切正常，这意味着两者都匹配。

第三条路

最简单的方法，两个文件都是必需的。

  • CentOS-Stream-8-x86_64-20210603-boot.iso
  • 校验和

运行以下命令

sha256sum -c CHECKSUM

[chris@f34 verify-centos]$ sha256sum -c CHECKSUM
CentOS-Stream-8-x86_64-20210603-boot.iso: OK
sha256sum: CentOS-Stream-8-x86_64-20210603-dvd1.iso: No such file or directory
CentOS-Stream-8-x86_64-20210603-dvd1.iso: FAILED open or read
sha256sum: WARNING: 1 listed file could not be read
[chris@f34 verify-centos]$

正如我们所看到的，说“好吧”

CentOS-Stream-8-x86_64-20210603-boot.iso: OK

结尾。

相关内容