Skip to content

Commit f3cc67c

Browse files
gaelwilsongaelwilson
committed
Use the README from the signing extension
1 parent 13ad10a commit f3cc67c

File tree

2 files changed

+322
-2
lines changed

2 files changed

+322
-2
lines changed

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
vsix/*
2+
create-release.bat

‎README.md‎

Lines changed: 320 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,320 @@
1-
# AMC-VSCode-extension-learncobol
2-
Signing assets and vsix for the Rocket Software Inc. Rocket LearnCOBOL Visual Studio Code extension
1+
# Verifying the Digital Signature of a Rocket Software Inc. Extension for Visual Studio Code
2+
3+
4+
# Digital Signatures
5+
The Rocket Software, Inc. extensions for Visual Studio Code listed below use [PGP](https://en.wikipedia.org/wiki/Pretty_Good_Privacy) digital signatures to guarantee that the packages you are installing were created by Rocket Software, Inc. This readme guides you through the process of verifying these extensions on Windows and on Linux.
6+
7+
* [**Rocket Enterprise extension**](https://marketplace.visualstudio.com/items?itemName=RocketSoftware.rocket-enterprise)
8+
* [**Rocket COBOL extension**](https://marketplace.visualstudio.com/items?itemName=RocketSoftware.rocket-cobol)
9+
* [**Rocket Learn COBOL extension**](https://marketplace.visualstudio.com/items?itemName=RocketSoftware.rocket-learncobol)
10+
* [**Rocket JVM COBOL**](https://marketplace.visualstudio.com/items?itemName=RocketSoftware.rocket-jvmcobol)
11+
12+
13+
14+
## Software Requirements
15+
There are a number of open-source tools available for both Windows and Linux platforms which you can use to verify the marketplace extensions before you install them. This readmes uses [Gpg4win for Windows](https://www.gpg4win.org/) and [gnupgp for Linux](https://gnupg.org/).
16+
17+
# Verifying the Signature
18+
This readme includes example instructions for both Windows (using Gpg4win) and Red Hat Linux (using gnupgp).
19+
20+
1. Install the PGP tools:
21+
* On Windows - download and install [Gpg4win for Windows](https://www.gpg4win.org/)
22+
* On Linux, install gnupg using yum from a terminal:
23+
```
24+
yum install –y gnupg
25+
```
26+
This adds the PGP tools to the PATH environment variable on your machine.
27+
On Windows, however, you might need to add the Gpg4win installation folder manually to the PATH as follows:
28+
```
29+
set PATH=%PATH%;C:\Program Files (x86)\Gpg4win\bin
30+
```
31+
32+
2. Download the required extension file (```.vsix```) from the Visual Studio Marketplace:
33+
* [**Rocket Enterprise extension**](https://marketplace.visualstudio.com/items?itemName=RocketSoftware.rocket-enterprise&ssr=false#version-history)
34+
* [**Rocket COBOL extension**](https://marketplace.visualstudio.com/items?itemName=RocketSoftware.rocket-cobol&ssr=false#version-history)
35+
* [**Rocket Learn COBOL extension**](https://marketplace.visualstudio.com/items?itemName=RocketSoftware.rocket-learncobol&ssr=false#version-history)
36+
* [**Rocket JVM COBOL**](https://marketplace.visualstudio.com/items?itemName=RocketSoftware.rocket-jvmcobol&ssr=false#version-history)
37+
38+
**Note:** We recommend that you always download and install the latest version of the extensions.
39+
40+
3. Select the release from this GitHub repository which matches the version of the extension(s) you have downloaded. Download the signature (```.asc```) file for the selected release.
41+
42+
4. Use the checksum listed on this repository to verify the downloaded ```.vsix``` package.
43+
* On Windows:
44+
```
45+
sha256sum RocketSoftware.rocket-enterprise-2.0.0.vsix
46+
sha256sum RocketSoftware.rocket-cobol-2.0.0.vsix
47+
sha256sum RocketSoftware.rocket-learncobol-2.0.0.vsix
48+
sha256sum RocketSoftware.rocket-jvmcobol-2.0.0.vsix
49+
```
50+
* On Linux:
51+
```
52+
sha256sum ./RocketSoftware.rocket-enterprise-2.0.0.vsix
53+
sha256sum ./RocketSoftware.rocket-cobol-2.0.0.vsix
54+
sha256sum ./RocketSoftware.rocket-learncobol-2.0.0.vsix
55+
sha256sum ./RocketSoftware.rocket-jvmcobol-2.0.0.vsix
56+
```
57+
58+
**Important:** If a generated checksum does not match the value listed for the same release on this repository, you need to download the package again and repeat the verification process.
59+
60+
**Important:** Version 2.0.x of the COBOL, JVM COBOL, Enterprise and Learn COBOL extensions are all signed with a Rocket Software public key.
61+
62+
**Important:** Versions 1.0.55 to 1.0.59 of the COBOL and Enterprise extensions, versions 1.0.11 to 1.0.13 of Learn COBOL extension and versions 1.0.2 to 1.0.3 of the JVM COBOL extension are all signed with an OpenText public key. Prior to this all extensions were signed with a Micro Focus public key. Details are provided below to describe how to verify with both the OpenText and Micro Focus public keys.
63+
64+
### To verify using the Rocket Software public key
65+
5. Extract the public key from the ```.vsix``` package. The ```.vsix``` package can be treated as a ZIP archive so you can use any archive utility such az 7-zip on Windows:
66+
67+
* On Windows:
68+
```
69+
"C:\Program Files\7-Zip\7z.exe" e RocketSoftware.rocket-cobol-2.0.0.vsix extension\Rocket.package-sign.pub
70+
```
71+
* On Linux:
72+
```
73+
unzip RocketSoftware.rocket-cobol-2.0.0.vsix extension/Rocket.package-sign.pub
74+
```
75+
76+
6. To view the fingerprint of the exported public key, run the following command:
77+
* On Windows:
78+
```
79+
gpg --import --import-options show-only --dry-run Rocket.package-sign.pub
80+
```
81+
* On Linux:
82+
```
83+
gpg2 --import --import-options show-only --dry-run extension/Rocket.package-sign.pub
84+
```
85+
The expected output is in a format similar to the following where the asterisks indicate the fingerprint value:
86+
```
87+
pub rsa4096 2024-05-14 [SC]
88+
4BCACD85F7618C855216DD8C56A5D1B5263069BE
89+
uid Rocket-package-sign (Rocket Software, Inc. Package signing - 20240514) <Rocket-package-sign@rocketsoftware.com>
90+
```
91+
**Important:** To verify that the public key is correct, the fingerprint must match the following value:
92+
93+
**Key fingerprint: 4BCA CD85 F761 8C85 5216 DD8C 56A5 D1B5 2630 69BE**
94+
95+
**You should only proceed with importing the public key into the local keystore if the key fingerprint matches this value.**
96+
97+
7. To import the public key into the local keystore:
98+
* On Windows:
99+
```
100+
gpg --import Rocket.package-sign.pub
101+
```
102+
* Linux:
103+
```
104+
gpg2 --import extension/Rocket.package-sign.pub
105+
```
106+
107+
8. Once imported, you need to sign the key in your keystore with a private key.
108+
109+
This is required so that you can provide information to your local system that the signing certificate imported in this step has passed all the checks performed in the previous steps. If you do not provide this information, the system reports that the imported certificate is not trusted when you try to verify the ```.vsix``` package.
110+
111+
You need an existing private key to sign the key. Follow the prompts to sign the public key:
112+
* On Windows:
113+
```
114+
gpg --lsign-key "4BCA CD85 F761 8C85 5216 DD8C 56A5 D1B5 2630 69BE"
115+
```
116+
* On Linux:
117+
```
118+
gpg2 --lsign-key "4BCA CD85 F761 8C85 5216 DD8C 56A5 D1B5 2630 69BE"
119+
```
120+
121+
**Important:** If you receive the following output, it indicates that no private key exists. In this case you need to create a new private key and retry this step:
122+
123+
```
124+
gpg: no default secret key: No secret key
125+
Key has not been changed, so no save is needed.
126+
```
127+
128+
10. To verify the ```.vsix``` package using the signature file:
129+
* On Windows:
130+
```
131+
gpg --verify RocketSoftware.rocket-cobol-2.0.0.vsix.asc RocketSoftware.rocket-cobol-2.0.0.vsix
132+
gpg --verify RocketSoftware.rocket-enterprise-2.0.0.vsix.asc RocketSoftware.rocket-enterprise-2.0.0.vsix
133+
gpg --verify RocketSoftware.rocket-learncobol-2.0.0.vsix.asc RocketSoftware.rocket-learncobol-2.0.0.vsix
134+
```
135+
* On Linux:
136+
```
137+
gpg2 --verify RocketSoftware.rocket-cobol-2.0.0.vsix.asc RocketSoftware.rocket-cobol-2.0.0.vsix
138+
gpg2 --verify RocketSoftware.rocket-enterprise-2.0.0.vsix.asc RocketSoftware.rocket-enterprise-2.0.0.vsix
139+
gpg2 --verify RocketSoftware.rocket-learncobol-2.0.0.vsix.asc RocketSoftware.rocket-learncobol-2.0.0.vsix
140+
```
141+
The output from the verification must report a valid signature from Rocket Software, Inc.
142+
143+
144+
### To verify using the Open Text public key
145+
5. Extract the public key from the ```.vsix``` package. The ```.vsix``` package can be treated as a ZIP archive so you can use any archive utility such az 7-zip on Windows:
146+
147+
* On Windows:
148+
```
149+
"C:\Program Files\7-Zip\7z.exe" e Micro-Focus-AMC.mfcobol-1.0.55.vsix extension\ot-package-sign.pub
150+
```
151+
* On Linux:
152+
```
153+
unzip Micro-Focus-AMC.mfcobol-1.0.55.vsix extension/ot-package-sign.pub
154+
```
155+
156+
6. To view the fingerprint of the exported public key, run the following command:
157+
* On Windows:
158+
```
159+
gpg --import --import-options show-only --dry-run ot-package-sign.pub
160+
```
161+
* On Linux:
162+
```
163+
gpg2 --import --import-options show-only --dry-run extension/ot-package-sign.pub
164+
```
165+
The expected output is in a format similar to the following where the asterisks indicate the fingerprint value:
166+
```
167+
pub rsa4096 2023-04-20 [SC]
168+
**23DF1905A3DF04718BDFD1F5F8EEBBCDE08E4762**
169+
uid OT-package-sign (Open Text Corporation package signing certificate 20230420) <OT-package-sign@opentext.com>
170+
```
171+
**Important:** To verify that the public key is correct, the fingerprint must match the following value:
172+
173+
**Key fingerprint: 23DF 1905 A3DF 0471 8BDF D1F5 F8EE BBCD E08E 4762**
174+
175+
**You should only proceed with importing the public key into the local keystore if the key fingerprint matches this value.**
176+
177+
7. To import the public key into the local keystore:
178+
* On Windows:
179+
```
180+
gpg --import ot-package-sign.pub
181+
```
182+
* Linux:
183+
```
184+
gpg2 --import extension/ot-package-sign.pub
185+
```
186+
187+
8. Once imported, you need to sign the key in your keystore with a private key.
188+
189+
This is required so that you can provide information to your local system that the signing certificate imported in this step has passed all the checks performed in the previous steps. If you do not provide this information, the system reports that the imported certificate is not trusted when you try to verify the ```.vsix``` package.
190+
191+
You need an existing private key to sign the key. Follow the prompts to sign the public key:
192+
* On Windows:
193+
```
194+
gpg --lsign-key "23DF 1905 A3DF 0471 8BDF D1F5 F8EE BBCD E08E 4762"
195+
```
196+
* On Linux:
197+
```
198+
gpg2 --lsign-key "23DF 1905 A3DF 0471 8BDF D1F5 F8EE BBCD E08E 4762"
199+
```
200+
201+
**Important:** If you receive the following output, it indicates that no private key exists. In this case you need to create a new private key and retry this step:
202+
203+
```
204+
gpg: no default secret key: No secret key
205+
Key has not been changed, so no save is needed.
206+
```
207+
208+
10. To verify the ```.vsix``` package using the signature file:
209+
* On Windows:
210+
```
211+
gpg --verify Micro-Focus-AMC.mfcobol-1.0.55.vsix.asc Micro-Focus-AMC.mfcobol-1.0.55.vsix
212+
gpg --verify Micro-Focus-AMC.mfenterprise-1.0.55.vsix.asc Micro-Focus-AMC.mfenterprise-1.0.55.vsix
213+
gpg --verify Micro-Focus-AMC.learncobol-1.0.11.vsix.asc Micro-Focus-AMC.learncobol-1.0.11.vsix
214+
```
215+
* On Linux:
216+
```
217+
gpg2 --verify Micro-Focus-AMC.mfcobol-1.0.55.vsix.asc Micro-Focus-AMC.mfcobol-1.0.55.vsix
218+
gpg2 --verify Micro-Focus-AMC.mfenterprise-1.0.55.vsix.asc Micro-Focus-AMC.mfenterprise-1.0.55.vsix
219+
gpg2 --verify Micro-Focus-AMC.learncobol-1.0.11.vsix.asc Micro-Focus-AMC.learncobol-1.0.11.vsix
220+
```
221+
The output from the verification must report a valid signature from Open Text Corporation.
222+
223+
224+
### To verify using the Micro Focus public key
225+
5. Extract the public key from the ```.vsix``` package. The ```.vsix``` package can be treated as a ZIP archive so you can use any archive utility such az 7-zip on Windows:
226+
227+
* On Windows:
228+
```
229+
"C:\Program Files\7-Zip\7z.exe" e Micro-Focus-AMC.mfcobol-1.0.54.vsix extension\MicroFocusGPGPackageSign.pub
230+
```
231+
* On Linux:
232+
```
233+
unzip Micro-Focus-AMC.mfcobol-1.0.54.vsix extension/MicroFocusGPGPackageSign.pub
234+
```
235+
236+
6. To view the fingerprint of the exported public key, run the following command:
237+
* On Windows:
238+
```
239+
gpg --import --import-options show-only --dry-run extension\MicroFocusGPGPackageSign.pub
240+
```
241+
* On Linux:
242+
```
243+
gpg2 --import --import-options show-only --dry-run extension/MicroFocusGPGPackageSign.pub
244+
```
245+
The expected output is in a format similar to the following where the asterisks indicate the fingerprint value:
246+
```
247+
pub rsa4096 2020-04-22 [SC]
248+
**A15D0CFFD6DF76C4C8473AFE3288E0D0786EC7C0**
249+
uid mf-master-sign (Micro Focus International package signing certificate 2020-04-22) <mf-master-sign@microfocus.com>
250+
```
251+
**Important:** To verify that the public key is correct, the fingerprint must match the following value:
252+
253+
**Key fingerprint: A15D 0CFF D6DF 76C4 C847 3AFE 3288 E0D0 786E C7C0**
254+
255+
**You should only proceed with importing the public key into the local keystore if the key fingerprint matches this value.**
256+
257+
7. To import the public key into the local keystore:
258+
* On Windows:
259+
```
260+
gpg --import extension\MicroFocusGPGPackageSign.pub
261+
```
262+
* Linux:
263+
```
264+
gpg2 --import extension/MicroFocusGPGPackageSign.pub
265+
```
266+
267+
8. Once imported, you need to sign the key in your keystore with a private key.
268+
269+
This is required so that you can provide information to your local system that the signing certificate imported in this step has passed all the checks performed in the previous steps. If you do not provide this information, the system reports that the imported certificate is not trusted when you try to verify the ```.vsix``` package.
270+
271+
You need an existing private key to sign the key. Follow the prompts to sign the public key:
272+
* On Windows:
273+
```
274+
gpg --lsign-key "A15D 0CFF D6DF 76C4 C847 3AFE 3288 E0D0 786E C7C0"
275+
```
276+
* On Linux:
277+
```
278+
gpg2 --lsign-key "A15D 0CFF D6DF 76C4 C847 3AFE 3288 E0D0 786E C7C0"
279+
```
280+
281+
**Important:** If you receive the following output, it indicates that no private key exists. In this case you need to create a new private key and retry this step:
282+
283+
```
284+
gpg: no default secret key: No secret key
285+
Key has not been changed, so no save is needed.
286+
```
287+
288+
10. To verify the ```.vsix``` package using the signature file:
289+
* On Windows:
290+
```
291+
gpg --verify Micro-Focus-AMC.mfcobol-1.0.54.vsix.asc Micro-Focus-AMC.mfcobol-1.0.54.vsix
292+
gpg --verify Micro-Focus-AMC.mfenterprise-1.0.54.vsix.asc Micro-Focus-AMC.mfenterprise-1.0.54.vsix
293+
gpg --verify Micro-Focus-AMC.learncobol-1.0.10.vsix.asc Micro-Focus-AMC.learncobol-1.0.10.vsix
294+
```
295+
* On Linux:
296+
```
297+
gpg2 --verify Micro-Focus-AMC.mfcobol-1.0.54.vsix.asc Micro-Focus-AMC.mfcobol-1.0.54.vsix
298+
gpg2 --verify Micro-Focus-AMC.mfenterprise-1.0.54.vsix.asc Micro-Focus-AMC.mfenterprise-1.0.54.vsix
299+
gpg2 --verify Micro-Focus-AMC.learncobol-1.0.10.vsix.asc Micro-Focus-AMC.learncobol-1.0.10.vsix
300+
```
301+
The output from the verification must report a valid signature from Micro Focus International.
302+
303+
11. If the verification process reports an error, check the **Common Issues** below.
304+
305+
## Common Issues
306+
**Issue:**
307+
> Can't check signature: No public key
308+
309+
**Resolution:**
310+
Double-check that the public key has been imported into the local system.
311+
312+
**Issue:**
313+
> Invalid signature
314+
315+
**Resolution:**
316+
- Double-check that the correct signature version is being used.
317+
- Double-check the checksum of the downloaded .vsix package.
318+
319+
320+
If the problem persists, visit the [Community Forum](https://community.microfocus.com/cobol/visualcobol/) or, if you have a maintenance contract for Rocket&#174; Visual COBOL or Rocket&#174;Enterprise Developer, contact [Rocket Software Customer Care](https://www.microfocus.com/en-us/support).

0 commit comments

Comments
 (0)