Verify Integrity of MongoDB Packages
On this page
The MongoDB release team digitally signs all software packages to certify that a particular MongoDB package is a valid and unaltered MongoDB release. Before installing MongoDB, you should validate the package using either the provided PGP signature or SHA-256 checksum.
PGP signatures provide the strongest guarantees by checking both the authenticity and integrity of a file to prevent tampering.
Cryptographic checksums only validate file integrity to prevent network transmission errors.
Verify Linux/macOS Packages
Use PGP/GPG
MongoDB signs each release branch with a different PGP key. The public key files for each release branch since MongoDB 2.2 are available for download from the key server in both textual .asc
and binary .pub
formats.
Verify the MongoDB installation file.
Run this command:
GPG should return this response:
If the package is properly signed, but you do not currently trust the signing key in your local trustdb
, gpg
will also return the following message:
If you receive a message this error message, confirm that you imported the correct public key:
Verify Windows Packages
This verifies the MongoDB binary against its SHA256 key. This tutorial uses the latest release of MongoDB Community Edition 3.4, but the procedure works on all versions and editions.
Download the Sigcheck utility from Microsoft.
Visit the Sigcheck utility page .
Click the Download Sigcheck link.
Unzip
Sigcheck.zip
.Move the Sigcheck directory to an appropriate location on your Windows host.
For this tutorial, this location is
$Env:ProgramFiles\Sigcheck
.
Compare the signature file to the MongoDB installer hash.
To compare the signature file to the hash of the MongoDB binary, invoke this Powershell script:
The command outputs three lines:
- A
SHA256
hash that you downloaded directly from MongoDB. - A
SHA256
hash computed from the MongoDB binary you downloaded from MongoDB. - A
True
orFalse
result depending if the hashes match.
If the hashes match, the MongoDB binary is verified.