Install MongoDB >
Verify Integrity of MongoDB Packages

Verify Integrity of MongoDB Packages¶

Overview¶

The MongoDB release team digitally signs all software packages to certify that a particular MongoDB package is a valid and unaltered MongoDB release. Before installing MongoDB, you should validate the package using either the provided PGP signature or SHA-256 checksum.

PGP signatures provide the strongest guarantees by checking both the authenticity and integrity of a file to prevent tampering.

Cryptographic checksums only validate file integrity to prevent network transmission errors.

Procedures¶

Use PGP/GPG¶

MongoDB signs each release branch with a different PGP key. The public key files for each release branch since MongoDB 2.2 are available for download from the key server in both textual .asc and binary .pub formats.

1

Download the MongoDB installation file.¶

Download the binaries from https://www.mongodb.org/downloads based on your environment.

For example, to download the 2.6.0 release for OS X through the shell, type this command:

curl -LO http://downloads.mongodb.org/osx/mongodb-osx-x86_64-2.6.0.tgz

2

Download the public signature file.¶

curl -LO http://downloads.mongodb.org/osx/mongodb-osx-x86_64-2.6.0.tgz.sig

3

Download then import the key file.¶

If you have not downloaded and imported the key file, enter these commands:

curl -LO https://www.mongodb.org/static/pgp/server-2.6.asc
gpg --import server-2.6.asc

You should receive this message:

gpg: key AAB2461C: public key "MongoDB 2.6 Release Signing Key <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1  (RSA: 1)

4

Verify the MongoDB installation file.¶

Type this command:

gpg --verify mongodb-osx-x86_64-2.6.0.tgz.sig mongodb-osx-x86_64-2.6.0.tgz

You should receive this message:

gpg: Signature made Thu Mar  6 15:11:28 2014 EST using RSA key ID AAB2461C
gpg: Good signature from "MongoDB 2.6 Release Signing Key <[email protected]>"

Download and import the key file, as described above, if you receive a message like this one:

gpg: Signature made Thu Mar  6 15:11:28 2014 EST using RSA key ID AAB2461C
gpg: Can't check signature: public key not found

gpg will return the following message if the package is: properly signed, but you do not currently trust the signing key in your local trustdb.

gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: DFFA 3DCF 326E 302C 4787  673A 01C4 E7FA AAB2 461C

Use SHA-256¶

1

Download the MongoDB installation file.¶

Download the binaries from https://www.mongodb.org/downloads based on your environment.

For example, to download the 3.0.4 release for OS X through the shell, type this command:

curl -LO https://fastdl.mongodb.org/osx/mongodb-osx-x86_64-3.0.4.tgz

2

Download the SHA256 file.¶

curl -LO https://fastdl.mongodb.org/osx/mongodb-osx-x86_64-3.0.4.tgz.sha256

3

Use the SHA-256 checksum to verify the MongoDB package file.¶

Compute the checksum of the package file:

shasum -c mongodb-osx-x86_64-3.0.4.tgz.sha256

which should return the following if the checksum matched the downloaded package:

mongodb-osx-x86_64-3.0.4.tgz: OK

← Install MongoDB Enterprise on Windows MongoDB CRUD Operations →

Was this page helpful?

Yes No

Thank you for your feedback!

We're sorry! You can Report a Problem to help us improve this page.