Verify a release signature by hand¶

When you finish, you have confirmed by hand that a provider zip matches the checksums Qumulo signed.

Before you start¶

curl, gpg, and jq
The release version you are verifying

1. Download the release artifacts¶

VERSION=1.4.22         # <-- Replace with the release version
PLATFORM=linux_amd64   # <-- Replace with your platform: linux_amd64, linux_arm64, darwin_amd64, darwin_arm64, windows_amd64
BASE_URL="https://qumulo-terraform-registry.s3.us-east-1.amazonaws.com/releases/qumulo/${VERSION}"

curl -O "${BASE_URL}/terraform-provider-qumulo_${VERSION}_${PLATFORM}.zip"
curl -O "${BASE_URL}/terraform-provider-qumulo_${VERSION}_SHA256SUMS"
curl -O "${BASE_URL}/terraform-provider-qumulo_${VERSION}_SHA256SUMS.sig"

The directory now holds the zip, the SHA256SUMS file, and the SHA256SUMS.sig file.

2. Get the GPG public key¶

Take the key from the registry metadata, the same place Terraform reads it.

METADATA="https://qumulo-terraform-registry.s3.us-east-1.amazonaws.com/v1/providers/qumulo/qumulo/${VERSION}/download/linux/amd64"
curl -s "$METADATA" | jq -r '.signing_keys.gpg_public_keys[0].ascii_armor' > qumulo-terraform-gpg-public.asc
curl -s "$METADATA" | jq -r '.signing_keys.gpg_public_keys[0].key_id'

qumulo-terraform-gpg-public.asc starts with -----BEGIN PGP PUBLIC KEY BLOCK-----, and the last command prints the key ID.

3. Import the key¶

gpg --import qumulo-terraform-gpg-public.asc

The output reports one public key imported.

4. Verify the signature¶

gpg --verify \
  "terraform-provider-qumulo_${VERSION}_SHA256SUMS.sig" \
  "terraform-provider-qumulo_${VERSION}_SHA256SUMS"

The output includes Good signature from "Qumulo ...". A WARNING: This key is not certified with a trusted signature line is normal until you mark the key as trusted in your keyring.

5. Verify the checksum¶

LinuxmacOSWindows

sha256sum -c "terraform-provider-qumulo_${VERSION}_SHA256SUMS" --ignore-missing

shasum -a 256 -c "terraform-provider-qumulo_${VERSION}_SHA256SUMS" --ignore-missing

Get-FileHash -Algorithm SHA256 .\terraform-provider-qumulo_1.4.22_windows_amd64.zip # <-- Replace with your zip

On Linux and macOS the output is terraform-provider-qumulo_1.4.22_linux_amd64.zip: OK. On Windows, the printed hash matches the zip's line in the SHA256SUMS file.

6. Match the key to what Terraform saw¶

After a terraform init, compare the key ID in its - Installed ... (self-signed, key ID ...) line with the key ID from step 2. The two IDs are identical.

Fix verification errors¶

Symptom	Fix
Checksum or signature verification fails	Re-download the artifacts directly from the registry host and repeat steps 1 to 5. A proxy that intercepts or rewrites downloads is the most common cause.

Next¶

Carry the verified zip to a host with no internet through Install in an air-gapped environment.