本文為英文版的機器翻譯版本,如內容有任何歧義或不一致之處,概以英文版為準。
可選:驗證 AWS SAMCLI安裝程式的完整性
使用套件安裝程式安裝 AWS Serverless Application Model 命令列介面 (AWS SAMCLI) 時,您可以在安裝之前驗證其完整性。這是選擇性的步驟,但強烈建議您使用。
您可以使用以下兩種驗證選項:
-
驗證套件安裝程式簽章檔案。
-
驗證套件安裝程式雜湊值。
如果您的平台可用,我們建議您驗證簽名檔案選項。此選項提供額外的安全層,因為金鑰值會在此發佈,並與我們的GitHub儲存庫分開管理。
驗證安裝程式簽章檔
Linux
arm64-命令行安裝程序
AWS SAM 使用 GnuPG
-
使用主要公開金鑰驗證簽署者的公開金鑰。
-
使用簽署者公開金鑰來驗證 AWS SAMCLI套件安裝程式。
驗證簽署者公開金鑰的完整性
-
複製主要公開金鑰,並以
.txt
檔案形式儲存到本機電腦。例如
。primary-public-key.txt
-----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v2.0.22 (GNU/Linux) mQINBGRuSzMBEADsqiwOy78w7F4+sshaMFRIwRGNRm94p5Qey2KMZBxekFtoryVD D9jEOnvupx4tvhfBHz5EcUHCEOdl4MTqdBy6vVAshozgxVb9RE8JpECn5lw7XC69 4Y7Gy1TKKQMEWtDXElkGxIFdUWvWjSnPlzfnoXwQYGeE93CUS3h5dImP22Yk1Ct6 eGGhlcbg1X4L8EpFMj7GvcsU8f7ziVI/PyC1Xwy39Q8/I67ip5eU5ddxO/xHqrbL YC7+8pJPbRMej2twT2LrcpWWYAbprMtRoa6WfE0/thoo3xhHpIMHdPfAA86ZNGIN kRLjGUg7jnPTRW4Oin3pCc8nT4Tfc1QERkHm641gTC/jUvpmQsM6h/FUVP2i5iE/ JHpJcMuL2Mg6zDo3x+3gTCf+Wqz3rZzxB+wQT3yryZs6efcQy7nROiRxYBxCSXX0 2cNYzsYLb/bYaW8yqWIHD5IqKhw269gp2E5Khs60zgS3CorMb5/xHgXjUCVgcu8a a8ncdf9fjl3WS5p0ohetPbO2ZjWv+MaqrZOmUIgKbA4RpWZ/fU97P5BW9ylwmIDB sWy0cMxg8MlvSdLytPieogaM0qMg3u5qXRGBr6Wmevkty0qgnmpGGc5zPiUbtOE8 CnFFqyxBpj5IOnG0KZGVihvn+iRxrv6GO7WWO92+Dc6m94U0EEiBR7QiOwARAQAB tDRBV1MgU0FNIENMSSBQcmltYXJ5IDxhd3Mtc2FtLWNsaS1wcmltYXJ5QGFtYXpv bi5jb20+iQI/BBMBCQApBQJkbkszAhsvBQkHhM4ABwsJCAcDAgEGFQgCCQoLBBYC AwECHgECF4AACgkQQv1fenOtiFqTuhAAzi5+ju5UVOWqHKevOJSO08T4QB8HcqAE SVO3mY6/j29knkcL8ubZP/DbpV7QpHPI2PB5qSXsiDTP3IYPbeY78zHSDjljaIK3 njJLMScFeGPyfPpwMsuY4nzrRIgAtXShPA8N/k4ZJcafnpNqKj7QnPxiC1KaIQWm pOtvb8msUF3/s0UTa5Ys/lNRhVC0eGg32ogXGdojZA2kHZWdm9udLo4CDrDcrQT7 NtDcJASapXSQL63XfAS3snEc4e1941YxcjfYZ33rel8K9juyDZfi1slWR/L3AviI QFIaqSHzyOtP1oinUkoVwL8ThevKD3Ag9CZflZLzNCV7yqlF8RlhEZ4zcE/3s9El WzCFsozb5HfE1AZonmrDh3SyOEIBMcS6vG5dWnvJrAuSYv2rX38++K5Pr/MIAfOX DOI1rtA+XDsHNv9lSwSy0lt+iClawZANO9IXCiN1rOYcVQlwzDFwCNWDgkwdOqS0 gOA2f8NF9lE5nBbeEuYquoOl1Vy8+ICbgOFs9LoWZlnVh7/RyY6ssowiU9vGUnHI L8f9jqRspIz/Fm3JD86ntZxLVGkeZUz62FqErdohYfkFIVcv7GONTEyrz5HLlnpv FJ0MR0HjrMrZrnOVZnwBKhpbLocTsH+3t5It4ReYEX0f1DIOL/KRwPvjMvBVkXY5 hblRVDQoOWc= =d9oG -----END PGP PUBLIC KEY BLOCK-----
-
將主要公開金鑰匯入您的金鑰圈。
$
gpg --import
gpg: directory `/home/.../.gnupg' created gpg: new configuration file `/home/.../.gnupg/gpg.conf' created gpg: WARNING: options in `/home/.../.gnupg/gpg.conf' are not yet active during this run gpg: keyring `/home/.../.gnupg/secring.gpg' created gpg: keyring `/home/.../.gnupg/pubring.gpg' created gpg: /home/.../.gnupg/trustdb.gpg: trustdb created gpg: key 73AD885A: public key "AWS SAM CLI Primary <aws-sam-cli-primary@amazon.com>" imported gpg: Total number processed: 1 gpg: imported: 1 (RSA: 1)primary-public-key.txt
-
複製簽署者公開金鑰,並以
.txt
檔案形式儲存至本機電腦。例如
。signer-public-key.txt
-----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v2.0.22 (GNU/Linux) mQINBGRtS20BEAC7GjaAwverrB1zNEu2q3EGI6HC37WzwL5dy30f4LirZOWS3piK oKfTqPjXPrLCf1GL2mMqUSgSnpEbPNXuvWTW1CfSnnjwuH8ZqbvvUQyHJwQyYpKm KMwb+8V0bzzQkMzDVqolYQCi5XyGpAuo3wroxXSzG6r/mIhbiq3aRnL+2lo4XOYk r7q9bhBqbJhzjkm7N62PhPWmi/+/EGdEBakA1pReE+cKjP2UAp5L6CPShQl2fRKL 9BumitNfFHHs1JZgZSCCruiWny3XkUaXUEMfyoE9nNbfqNvuqV2KjWguZCXASgz2 ZSPF4DTVIBMfP+xrZGQSWdGU/67QdysDQW81TbFOjK9ZsRwwGC4kbg/K98IsCNHT ril5RZbyr8pw3fw7jYjjI2ElAacRWp53iRzvutm5AruPpLfoKDQ/tKzBUYItBwlu Z/diKgcqtw7xDlyqNyTN8xFPFqMO2I8IsZ2Pdl131htdFiZMiin1RQG9pV9p2vHS eQVY2uKCnvnA6vFCQYKXP7p0IwReuPNzDvECUsidw8VTakTqZsANT/bU17e4KuKn +JgbNrKOasJX37sDb/9ruysozLvy78ozYKJDLmC3yoRQ8DhEjviT4cnjORgNmvnZ 0a5AA/DJPQW4buRrXdxu+fITzBxQn2+GO/iDNCxtJaq5SYVBKjTmTWPUJwARAQAB tDBBV1MgU0FNIENMSSBUZWFtIDxhd3Mtc2FtLWNsaS1zaWduZXJAYW1hem9uLmNv bT6JAj8EEwEJACkFAmRtS20CGy8FCQPCZwAHCwkIBwMCAQYVCAIJCgsEFgIDAQIe AQIXgAAKCRDHoF9D/grd+lE4D/4kJW65He2LNsbLTta7lcGfsEXCf4zgIvkytS7U 3R36zMD8IEyWJjlZ+aPkIP8/jFJrFl4pVHbU7vX85Iut1vV7m+8BgWt25mJhnoJ9 KPjXGra9mYP+Cj8zFAcjvtl3NBAPodyfcfCTWsU3umF9ArOFICcrGCzHX2SS7wX5 h9n0vYRZxk5Qj5FsgskKAQLq33CKFAMlaqZnL5gWRvTeycSIxsyus+stX+8YBPCO J64f7+y+MPIP1+m2njlVXg1xLEMMVa08oWccOMiakgzDev3LCrPy+wdwdn7Ut7oA pna3DNy9aYNd2lh6vUCJeJ+Yi1Bl2jYpzLcCLKrHUmln9/rRSz7Orbg8P181kfPu G/M7CD5FwhxP3p4+0XoGwxQefrV2jqpSnbLae7xbYJiJAhbpjWDQhuNGUbPcDmqk aH0Q3XU8AonJ8YqaQ/q3VZ3JBiH3TbBrOXsvd59cwxYyf83aJ/WLCb2P8y75zDad lnOP713ThF5J/Afj9HjO9waFV0Z2W2ZZe4rU2OJTAiXEtM8xsFMrc7TCUacJtJGs u4kdBmXREcVpSz65h9ImSy2ner9qktnVVCW4mZPj63IhB37YtoLAMyz3a3R2RFNk viEX8foOTUg1FmwHoftxZ9P91QwLoTajkDrh26ueIe45sG6Uxua2AP4Vo37cFfCj ryV8OokCHAQQAQkABgUCZG5MWAAKCRBC/V96c62IWmglD/9idU43kW8Zy8Af1j8l Am3lI4d9ksOleeKRZqxo/SZ5rovF32DO2nw7XRXq1+EbhgJaI3QwwOi0U0pfAMVT 4b9TdxdH+n+tqzCHh3jZqmo9sw+c9WFXYJN1hU9bLzcHXS8hOTbyoE2EuXx56ds9 L/BWCcd+LIvapw0lggFfavVx/QF4C7nBKjnJ66+xxwfgVIKR7oGlqDiHMfp9ZWh5 HhEqZo/nrNhdY0h3sczEdqC2N6eIa8mgHffHZdKudDMXIXHbgdhW9pcZXDIktVf7 j9wehsWOyYXiRgR0dz7DI26AUG4JLh5FTtx9XuSBdEsI69Jd4dJuibmgtImzbZjn 7un8DJWIyqi7Ckk96Tr4oXB9mYAXaWlR4C9j5XJhMNZgkOycuY2DADnbGmSb+1kA ju77H4ff84+vMDwUzUt2Wwb+GjzXu2g6Wh+bWhGSirYlel+6xYrI6beu1BDCFLq+ VZFE8WggjJHpwcL7CiqadfVIQaw4HY0jQFTSdwzPWhJvYjXFOhMkyCcjssbtmB+z /otfgySyQqThrD48RWS5GuyqCA+pK3UNmEJ11c1AXMdTn2VWInR1NOJNALQ2du3y q8t1vMsErVOJ7pkZ50F4ef17PE6DKrXX8ilwGFyVuX5ddyt/t9J5pC3sRwHWXVZx GXwoX75FwIEHA3n5Q7rZ69Ea6Q== =ZIO7 -----END PGP PUBLIC KEY BLOCK-----
-
將簽署者公開金鑰匯入您的金鑰圈。
$
gpg --import
gpg: key FE0ADDFA: public key "AWS SAM CLI Team <aws-sam-cli-signer@amazon.com>" imported gpg: Total number processed: 1 gpg: imported: 1 (RSA: 1) gpg: no ultimately trusted keys foundsigner-public-key.txt
記下輸出中的索引鍵值。例如
。FE0ADDFA
-
使用金鑰值取得並驗證簽署者的公開金鑰指紋。
$
gpg --fingerprint
pub 4096R/FE0ADDFA 2023-05-23 [expires: 2025-05-22] Key fingerprint = 37D8 BE16 0355 2DA7 BD6A 04D8 C7A0 5F43 FE0A DDFA uid AWS SAM CLI Team <aws-sam-cli-signer@amazon.com>FE0ADDFA
指紋應符合以下內容:
37D8 BE16 0355 2DA7 BD6A 04D8 C7A0 5F43 FE0A DDFA
如果指紋字串不相符,請勿使用 AWS SAMCLI安裝程式。透過在aws-sam-cli GitHub 存放庫中建立問題
,向 AWS SAM 專案團隊升級。 -
驗證簽署者公開金鑰的簽章:
$
gpg --check-sigs
pub 4096R/FE0ADDFA 2023-05-23 [expires: 2025-05-22] uid AWS SAM CLI Team <aws-sam-cli-signer@amazon.com> sig!3 FE0ADDFA 2023-05-23 AWS SAM CLI Team <aws-sam-cli-signer@amazon.com> sig! 73AD885A 2023-05-24 AWS SAM CLI Primary <aws-sam-cli-primary@amazon.com>FE0ADDFA
如果您看到
1 signature not checked due to a missing key
,請重複上述步驟,將主要和簽署者公開金鑰匯入金鑰圈。您應該會看到列出主要公開金鑰和簽署者公開金鑰的金鑰值。
現在您已驗證簽署者公開金鑰的完整性,您可以使用簽署者公開金鑰來驗證 AWS SAMCLI套件安裝程式。
驗證 AWS SAMCLI套件安裝程式的完整性
-
取得 AWS SAMCLI套件簽章檔案 — 使用下列指令下載 AWS SAMCLI套件安裝程式的簽章檔案:
$
wget https://github.com/aws/aws-sam-cli/releases/latest/download/aws-sam-cli-linux-arm64.zip.sig
-
驗證簽名檔案 — 將下載的
.sig
和檔.zip
案作為參數傳遞至指gpg
令。以下是範例:$
gpg --verify
aws-sam-cli-linux-arm64.zip.sig aws-sam-cli-linux-arm64.zip
輸出格式應類似以下內容:
gpg: Signature made Tue 30 May 2023 10:03:57 AM UTC using RSA key ID FE0ADDFA gpg: Good signature from "AWS SAM CLI Team <aws-sam-cli-signer@amazon.com>" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 37D8 BE16 0355 2DA7 BD6A 04D8 C7A0 5F43 FE0A DDFA
該
Good signature from "AWS SAM CLI Team <aws-sam-cli-signer@amazon.com>"
消息表示簽名已驗證,您可以隨著安裝繼續前進。
x86_64-命令行安裝程序
AWS SAM 使用 GnuPG
-
使用主要公開金鑰驗證簽署者的公開金鑰。
-
使用簽署者公開金鑰來驗證 AWS SAMCLI套件安裝程式。
驗證簽署者公開金鑰的完整性
-
複製主要公開金鑰,並以
.txt
檔案形式儲存到本機電腦。例如
。primary-public-key.txt
-----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v2.0.22 (GNU/Linux) mQINBGRuSzMBEADsqiwOy78w7F4+sshaMFRIwRGNRm94p5Qey2KMZBxekFtoryVD D9jEOnvupx4tvhfBHz5EcUHCEOdl4MTqdBy6vVAshozgxVb9RE8JpECn5lw7XC69 4Y7Gy1TKKQMEWtDXElkGxIFdUWvWjSnPlzfnoXwQYGeE93CUS3h5dImP22Yk1Ct6 eGGhlcbg1X4L8EpFMj7GvcsU8f7ziVI/PyC1Xwy39Q8/I67ip5eU5ddxO/xHqrbL YC7+8pJPbRMej2twT2LrcpWWYAbprMtRoa6WfE0/thoo3xhHpIMHdPfAA86ZNGIN kRLjGUg7jnPTRW4Oin3pCc8nT4Tfc1QERkHm641gTC/jUvpmQsM6h/FUVP2i5iE/ JHpJcMuL2Mg6zDo3x+3gTCf+Wqz3rZzxB+wQT3yryZs6efcQy7nROiRxYBxCSXX0 2cNYzsYLb/bYaW8yqWIHD5IqKhw269gp2E5Khs60zgS3CorMb5/xHgXjUCVgcu8a a8ncdf9fjl3WS5p0ohetPbO2ZjWv+MaqrZOmUIgKbA4RpWZ/fU97P5BW9ylwmIDB sWy0cMxg8MlvSdLytPieogaM0qMg3u5qXRGBr6Wmevkty0qgnmpGGc5zPiUbtOE8 CnFFqyxBpj5IOnG0KZGVihvn+iRxrv6GO7WWO92+Dc6m94U0EEiBR7QiOwARAQAB tDRBV1MgU0FNIENMSSBQcmltYXJ5IDxhd3Mtc2FtLWNsaS1wcmltYXJ5QGFtYXpv bi5jb20+iQI/BBMBCQApBQJkbkszAhsvBQkHhM4ABwsJCAcDAgEGFQgCCQoLBBYC AwECHgECF4AACgkQQv1fenOtiFqTuhAAzi5+ju5UVOWqHKevOJSO08T4QB8HcqAE SVO3mY6/j29knkcL8ubZP/DbpV7QpHPI2PB5qSXsiDTP3IYPbeY78zHSDjljaIK3 njJLMScFeGPyfPpwMsuY4nzrRIgAtXShPA8N/k4ZJcafnpNqKj7QnPxiC1KaIQWm pOtvb8msUF3/s0UTa5Ys/lNRhVC0eGg32ogXGdojZA2kHZWdm9udLo4CDrDcrQT7 NtDcJASapXSQL63XfAS3snEc4e1941YxcjfYZ33rel8K9juyDZfi1slWR/L3AviI QFIaqSHzyOtP1oinUkoVwL8ThevKD3Ag9CZflZLzNCV7yqlF8RlhEZ4zcE/3s9El WzCFsozb5HfE1AZonmrDh3SyOEIBMcS6vG5dWnvJrAuSYv2rX38++K5Pr/MIAfOX DOI1rtA+XDsHNv9lSwSy0lt+iClawZANO9IXCiN1rOYcVQlwzDFwCNWDgkwdOqS0 gOA2f8NF9lE5nBbeEuYquoOl1Vy8+ICbgOFs9LoWZlnVh7/RyY6ssowiU9vGUnHI L8f9jqRspIz/Fm3JD86ntZxLVGkeZUz62FqErdohYfkFIVcv7GONTEyrz5HLlnpv FJ0MR0HjrMrZrnOVZnwBKhpbLocTsH+3t5It4ReYEX0f1DIOL/KRwPvjMvBVkXY5 hblRVDQoOWc= =d9oG -----END PGP PUBLIC KEY BLOCK-----
-
將主要公開金鑰匯入您的金鑰圈。
$
gpg --import
gpg: directory `/home/.../.gnupg' created gpg: new configuration file `/home/.../.gnupg/gpg.conf' created gpg: WARNING: options in `/home/.../.gnupg/gpg.conf' are not yet active during this run gpg: keyring `/home/.../.gnupg/secring.gpg' created gpg: keyring `/home/.../.gnupg/pubring.gpg' created gpg: /home/.../.gnupg/trustdb.gpg: trustdb created gpg: key 73AD885A: public key "AWS SAM CLI Primary <aws-sam-cli-primary@amazon.com>" imported gpg: Total number processed: 1 gpg: imported: 1 (RSA: 1)primary-public-key.txt
-
複製簽署者公開金鑰,並以
.txt
檔案形式儲存至本機電腦。例如
。signer-public-key.txt
-----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v2.0.22 (GNU/Linux) mQINBGRtS20BEAC7GjaAwverrB1zNEu2q3EGI6HC37WzwL5dy30f4LirZOWS3piK oKfTqPjXPrLCf1GL2mMqUSgSnpEbPNXuvWTW1CfSnnjwuH8ZqbvvUQyHJwQyYpKm KMwb+8V0bzzQkMzDVqolYQCi5XyGpAuo3wroxXSzG6r/mIhbiq3aRnL+2lo4XOYk r7q9bhBqbJhzjkm7N62PhPWmi/+/EGdEBakA1pReE+cKjP2UAp5L6CPShQl2fRKL 9BumitNfFHHs1JZgZSCCruiWny3XkUaXUEMfyoE9nNbfqNvuqV2KjWguZCXASgz2 ZSPF4DTVIBMfP+xrZGQSWdGU/67QdysDQW81TbFOjK9ZsRwwGC4kbg/K98IsCNHT ril5RZbyr8pw3fw7jYjjI2ElAacRWp53iRzvutm5AruPpLfoKDQ/tKzBUYItBwlu Z/diKgcqtw7xDlyqNyTN8xFPFqMO2I8IsZ2Pdl131htdFiZMiin1RQG9pV9p2vHS eQVY2uKCnvnA6vFCQYKXP7p0IwReuPNzDvECUsidw8VTakTqZsANT/bU17e4KuKn +JgbNrKOasJX37sDb/9ruysozLvy78ozYKJDLmC3yoRQ8DhEjviT4cnjORgNmvnZ 0a5AA/DJPQW4buRrXdxu+fITzBxQn2+GO/iDNCxtJaq5SYVBKjTmTWPUJwARAQAB tDBBV1MgU0FNIENMSSBUZWFtIDxhd3Mtc2FtLWNsaS1zaWduZXJAYW1hem9uLmNv bT6JAj8EEwEJACkFAmRtS20CGy8FCQPCZwAHCwkIBwMCAQYVCAIJCgsEFgIDAQIe AQIXgAAKCRDHoF9D/grd+lE4D/4kJW65He2LNsbLTta7lcGfsEXCf4zgIvkytS7U 3R36zMD8IEyWJjlZ+aPkIP8/jFJrFl4pVHbU7vX85Iut1vV7m+8BgWt25mJhnoJ9 KPjXGra9mYP+Cj8zFAcjvtl3NBAPodyfcfCTWsU3umF9ArOFICcrGCzHX2SS7wX5 h9n0vYRZxk5Qj5FsgskKAQLq33CKFAMlaqZnL5gWRvTeycSIxsyus+stX+8YBPCO J64f7+y+MPIP1+m2njlVXg1xLEMMVa08oWccOMiakgzDev3LCrPy+wdwdn7Ut7oA pna3DNy9aYNd2lh6vUCJeJ+Yi1Bl2jYpzLcCLKrHUmln9/rRSz7Orbg8P181kfPu G/M7CD5FwhxP3p4+0XoGwxQefrV2jqpSnbLae7xbYJiJAhbpjWDQhuNGUbPcDmqk aH0Q3XU8AonJ8YqaQ/q3VZ3JBiH3TbBrOXsvd59cwxYyf83aJ/WLCb2P8y75zDad lnOP713ThF5J/Afj9HjO9waFV0Z2W2ZZe4rU2OJTAiXEtM8xsFMrc7TCUacJtJGs u4kdBmXREcVpSz65h9ImSy2ner9qktnVVCW4mZPj63IhB37YtoLAMyz3a3R2RFNk viEX8foOTUg1FmwHoftxZ9P91QwLoTajkDrh26ueIe45sG6Uxua2AP4Vo37cFfCj ryV8OokCHAQQAQkABgUCZG5MWAAKCRBC/V96c62IWmglD/9idU43kW8Zy8Af1j8l Am3lI4d9ksOleeKRZqxo/SZ5rovF32DO2nw7XRXq1+EbhgJaI3QwwOi0U0pfAMVT 4b9TdxdH+n+tqzCHh3jZqmo9sw+c9WFXYJN1hU9bLzcHXS8hOTbyoE2EuXx56ds9 L/BWCcd+LIvapw0lggFfavVx/QF4C7nBKjnJ66+xxwfgVIKR7oGlqDiHMfp9ZWh5 HhEqZo/nrNhdY0h3sczEdqC2N6eIa8mgHffHZdKudDMXIXHbgdhW9pcZXDIktVf7 j9wehsWOyYXiRgR0dz7DI26AUG4JLh5FTtx9XuSBdEsI69Jd4dJuibmgtImzbZjn 7un8DJWIyqi7Ckk96Tr4oXB9mYAXaWlR4C9j5XJhMNZgkOycuY2DADnbGmSb+1kA ju77H4ff84+vMDwUzUt2Wwb+GjzXu2g6Wh+bWhGSirYlel+6xYrI6beu1BDCFLq+ VZFE8WggjJHpwcL7CiqadfVIQaw4HY0jQFTSdwzPWhJvYjXFOhMkyCcjssbtmB+z /otfgySyQqThrD48RWS5GuyqCA+pK3UNmEJ11c1AXMdTn2VWInR1NOJNALQ2du3y q8t1vMsErVOJ7pkZ50F4ef17PE6DKrXX8ilwGFyVuX5ddyt/t9J5pC3sRwHWXVZx GXwoX75FwIEHA3n5Q7rZ69Ea6Q== =ZIO7 -----END PGP PUBLIC KEY BLOCK-----
-
將簽署者公開金鑰匯入您的金鑰圈。
$
gpg --import
gpg: key FE0ADDFA: public key "AWS SAM CLI Team <aws-sam-cli-signer@amazon.com>" imported gpg: Total number processed: 1 gpg: imported: 1 (RSA: 1) gpg: no ultimately trusted keys foundsigner-public-key.txt
記下輸出中的索引鍵值。例如
。FE0ADDFA
-
使用金鑰值取得並驗證簽署者的公開金鑰指紋。
$
gpg --fingerprint
pub 4096R/FE0ADDFA 2023-05-23 [expires: 2025-05-22] Key fingerprint = 37D8 BE16 0355 2DA7 BD6A 04D8 C7A0 5F43 FE0A DDFA uid AWS SAM CLI Team <aws-sam-cli-signer@amazon.com>FE0ADDFA
指紋應符合以下內容:
37D8 BE16 0355 2DA7 BD6A 04D8 C7A0 5F43 FE0A DDFA
如果指紋字串不相符,請勿使用 AWS SAMCLI安裝程式。透過在aws-sam-cli GitHub 存放庫中建立問題
,向 AWS SAM 專案團隊升級。 -
驗證簽署者公開金鑰的簽章:
$
gpg --check-sigs
pub 4096R/FE0ADDFA 2023-05-23 [expires: 2025-05-22] uid AWS SAM CLI Team <aws-sam-cli-signer@amazon.com> sig!3 FE0ADDFA 2023-05-23 AWS SAM CLI Team <aws-sam-cli-signer@amazon.com> sig! 73AD885A 2023-05-24 AWS SAM CLI Primary <aws-sam-cli-primary@amazon.com>FE0ADDFA
如果您看到
1 signature not checked due to a missing key
,請重複上述步驟,將主要和簽署者公開金鑰匯入金鑰圈。您應該會看到列出主要公開金鑰和簽署者公開金鑰的金鑰值。
現在您已驗證簽署者公開金鑰的完整性,您可以使用簽署者公開金鑰來驗證 AWS SAMCLI套件安裝程式。
驗證 AWS SAMCLI套件安裝程式的完整性
-
取得 AWS SAMCLI套件簽章檔案 — 使用下列指令下載 AWS SAMCLI套件安裝程式的簽章檔案:
$
wget https://github.com/aws/aws-sam-cli/releases/latest/download/aws-sam-cli-linux-x86_64.zip.sig
-
驗證簽名檔案 — 將下載的
.sig
和檔.zip
案作為參數傳遞至指gpg
令。以下是範例:$
gpg --verify
aws-sam-cli-linux-x86_64.zip.sig aws-sam-cli-linux-x86_64.zip
輸出格式應類似以下內容:
gpg: Signature made Tue 30 May 2023 10:03:57 AM UTC using RSA key ID FE0ADDFA gpg: Good signature from "AWS SAM CLI Team <aws-sam-cli-signer@amazon.com>" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 37D8 BE16 0355 2DA7 BD6A 04D8 C7A0 5F43 FE0A DDFA
該
Good signature from "AWS SAM CLI Team <aws-sam-cli-signer@amazon.com>"
消息表示簽名已驗證,您可以隨著安裝繼續前進。
macOS
GUI 和命令行安裝程序
您可以使用pkgutil
工具或手動驗證 AWS SAMCLI套件安裝程式簽章檔案的完整性。
若要使用 Pkgutil 進行驗證
-
執行下列命令,提供本機電腦上已下載安裝程式的路徑:
$
pkgutil --check-signature
/path/to/aws-sam-cli-installer.pkg
以下是範例:
$
pkgutil --check-signature
/Users/user/Downloads/aws-sam-cli-macos-arm64.pkg
-
從輸出中,找到SHA256 fingerprint的Developer ID Installer: AMZN Mobile LLC。以下是範例:
Package "aws-sam-cli-macos-arm64.pkg": Status: signed by a developer certificate issued by Apple for distribution Notarization: trusted by the Apple notary service Signed with a trusted timestamp on: 2023-05-16 20:29:29 +0000 Certificate Chain: 1. Developer ID Installer: AMZN Mobile LLC (94KV3E626L) Expires: 2027-06-28 22:57:06 +0000 SHA256 Fingerprint: 49 68 39 4A BA 83 3B F0 CC 5E 98 3B E7 C1 72 AC 85 97 65 18 B9 4C BA 34 62 BF E9 23 76 98 C5 DA ------------------------------------------------------------------------ 2. Developer ID Certification Authority Expires: 2031-09-17 00:00:00 +0000 SHA256 Fingerprint: F1 6C D3 C5 4C 7F 83 CE A4 BF 1A 3E 6A 08 19 C8 AA A8 E4 A1 52 8F D1 44 71 5F 35 06 43 D2 DF 3A ------------------------------------------------------------------------ 3. Apple Root CA Expires: 2035-02-09 21:40:36 +0000 SHA256 Fingerprint: B0 B1 73 0E CB C7 FF 45 05 14 2C 49 F1 29 5E 6E DA 6B CA ED 7E 2C 68 C5 BE 91 B5 A1 10 01 F0 24
-
Developer ID Installer: AMZN Mobile LLC SHA256 fingerprint應該符合下列值:
49 68 39 4A BA 83 3B F0 CC 5E 98 3B E7 C1 72 AC 85 97 65 18 B9 4C BA 34 62 BF E9 23 76 98 C5 DA
如果指紋字串不相符,請勿使用 AWS SAMCLI安裝程式。透過在aws-sam-cli GitHub 存放庫中建立問題
,向 AWS SAM 專案團隊升級。如果指紋字串不相符,您可以使用套件安裝程式繼續前進。
手動驗證套件安裝程式
-
請參閱 Apple 支援網站上的「如何驗證手動下載的 Apple 軟件更新」的真
實性。
Windows
AWS SAMCLI安裝程式會封裝為Windows作業系統的MSI檔案。
驗證安裝程式的完整性
-
右鍵單擊安裝程序並打開屬性窗口。
-
選擇 數位簽章 索引標籤。
-
從「簽名清單」中選擇「Amazon Web Services 公司」,然後選擇「詳細資料」。
-
選擇 General (一般) 索引標籤 (如果尚未選取),然後選擇 View Certificate (檢視憑證)。
-
選擇 [詳細資料] 索引標籤,然後在 [顯示] 下拉式清單中選擇 [全部] (如果尚未選取)。
-
向下捲動到看見 Thumbprint (指紋) 欄位為止,然後選擇 Thumbprint (指紋)。這會在下方的視窗中顯示整個指紋值。
-
將指紋值與下列值相符。如果值匹配,請繼續安裝。如果沒有,請在aws-sam-cli GitHub 存放庫中建立問題
,以呈報給 AWS SAM 專案團隊。 c011d416e99a1142c0e0235118ef64c2681f3db9
驗證哈希值
Linux
x86_64-命令行安裝程序
使用下列指令產生雜湊值,以驗證已下載安裝程式檔案的完整性與真實性:
$
sha256sum aws-sam-cli-linux-x86_64.zip
輸出應如下列範例所示:
<64-character SHA256 hash value>
aws-sam-cli-linux-x86_64.zip
將 64 個字元的 SHA-256 雜湊值與上GitHub的版本說明中所需 AWS SAMCLI版本的雜湊值進AWS SAMCLI行
macOS
GUI 和命令行安裝程序
使用下列命令產生雜湊值,以驗證下載安裝程式的完整性與真實性:
$
shasum -a 256
# Examplespath-to-pkg-installer
/name-of-pkg-installer
$
shasum -a 256
~/Downloads/
aws-sam-cli-macos-arm64.pkg$
shasum -a 256
~/Downloads/
aws-sam-cli-macos-x86_64.pkg
將 64 個字元的 SHA-256 雜湊值與AWS SAMCLI版本說明GitHub儲存庫中的對應值進行