Verifying the compiler package

After you get the compiler package, you can perform some tasks to verify the compiler package.

Note: You can still use the compiler package if the package is not verified.

For IBM Open SDK for Rust on AIX 1.96, downloadable tar.Z compiler packages are signed. The .pem public keys and separate .sig files that contain the signatures can be used to sign compiler packages.

The compiler public keys are available at https://ibm.biz/ibm-compiler-public-key-post2023.

Signature files are available at Fix list for IBM® Open SDK for Rust on AIX along with the compiler packages.

Verifying the signature

To verify the compiler package and run the following openssl command, which uses the package signature and the public key file:

openssl dgst -sha256 -verify IBMCompilers-publickey.pem -signature package_name.tar.Z.sig package_name.tar.Z

where package_name is the name of the compiler package that you downloaded.

Notes:

To use the openssl command, you must download and install OpenSSL. Refer to Downloading and Installing or Upgrading OpenSSL and OpenSSH for details.
Public keys that are used for verification can be renewed at regular intervals, but the signature is still valid.

(Optional) Verifying the key and certificate

To verify whether the public key provided is valid and signed by IBM, you can use the certificate and intermediate certificate to perform a manual check of the public key.

Comparing the certificate and the public key

To compare the certificate and the public key, run the following commands to show the details of the certificate and the public key:

Show the certificate details:

openssl x509 -text -in IBMCodeSignCert1221Certificate.pem -noout

Show the public key details:

openssl rsa -noout -text -inform PEM -in IBMCompilers-publickey.pem -pubin

Check the exponent of the public key and the certificate to confirm that the public key is the same as the one within the certificate. For example:

Certificate modulus:
                    00:e2:45:27:25:e9:a3:1f:c2:37:27:ac:4c:89:86:
                    ae:32:d5:2a:84:69:3b:01:cb:54:34:b0:b3:1b:6d: .......
                     Exponent: 65537 (0x10001)


Public key:
              00:e2:45:27:25:e9:a3:1f:c2:37:27:ac:4c:89:86:
              ae:32:d5:2a:84:69:3b:01:cb:54:34:b0:b3:1b:6d: .......
                     Exponent: 65537 (0x10001)

Checking the validity of the IBM public certificate

Run the following command to check if the IBM public certificate is valid with the DigiCert Certificate Authority:

openssl ocsp -no_nonce -issuer IBMCodeSignCert1221Chain0.pem -cert IBMCodeSignCert1221Certificate.pem  -VAfile IBMCodeSignCert1221Chain0.pem  -text -url http://ocsp.digicert.com -respout ocsptest

If the certificate is valid, the output is as follows:

Response verify OK