Validating the digital signature of the client package on Data Protection for VMware

The IBM Storage Protect Data Protection for VMware helps you protect information on your workstations.

You can maintain backup versions of your files that you can restore if the original files are damaged or lost. You can also archive infrequently used files, preserve them in their current state, and retrieve them when necessary.

Windows client package signature verification

Download the client package from the official IBM download site.
To verify client package integrity by using a SHA‑256 checksum, run the following command:
```
certitude -hashfile <client package> SHA256
```
Compare the computed SHA‑256 checksum with the checksum value provided on the download site. The values must match exactly.
Extract the client package.
Verify the digital signature by using the following method:
1. Right‑click the downloaded installation file (for example, spinstall.exe).
2. Select Properties > Digital Signatures. Confirm that the signature is issued by IBM Code Signing Certificate.
  Note: If the Digital Signatures tab is not displayed, the file is not digitally signed.

Linux

For Linux platform, the client package bundle includes the following files:

PRD0002117.pem.pub.key
<package_name>.sig

To verify the client package, run the following command:
```
openssl dgst -verify PRD0002117.pem.pub.key -keyform PEM -sha256 -signature <package_name>.sig -binary <package_name>
```
If the package is signed successfully, the output displays:
```
Verified OK
```
If the verification fails, the output displays:
```
Verification Failure
```

To verify the integrity and content of the public key, run the following command:

openssl rsa -noout -text -inform PEM -in PRD0002117.pem.pub.key -pubin

The output must indicate a 4096‑bit RSA public key with the expected modulus and exponent, for example:

RSA Public-Key: (4096 bit)
Modulus:
    00:af:f3:fb:a9:b0:bc:41:2f:0b:fc:4a:48:94:06:
    3d:44:b4:a5:7b:b2:58:59:83:60:7b:b9:b5:41:01:
    e8:75:5c:d2:61:d3:ab:7a:ae:42:d9:b0:54:81:2c:
    80:e1:2a:39:34:19:e2:df:8f:7d:6d:65:9c:5e:cb:
    27:46:a2:b5:0e:46:aa:1c:7c:1e:97:a2:83:60:16:
    4f:59:07:fc:4c:2a:37:48:f3:0c:d9:00:72:4e:32:
    ab:24:2c:88:c6:99:0c:35:26:35:9e:8b:89:d7:98:
    ab:6b:6f:72:24:b4:fd:8c:a8:64:4c:e8:bf:ed:86:
    86:89:6c:80:ed:30:fb:68:ef:77:8d:2f:88:69:c0:
    bf:15:cc:55:74:42:d8:2f:8f:f7:1b:4f:14:27:ff:
    39:99:5b:ac:8f:2e:b1:f4:ff:dc:69:28:d5:e4:24:
    0b:c7:9d:fc:51:1c:4b:59:f4:7d:25:38:27:7f:5d:
    41:24:28:f1:0f:a6:4f:11:38:2b:ed:a6:2d:59:ca:
    a2:86:37:5d:81:5a:6c:bf:6f:23:a5:94:86:45:82:
    0c:05:85:d6:45:f1:03:c4:fb:57:d6:b2:6a:4f:4e:
    5b:dd:1f:d8:a9:1c:1a:11:0a:1d:8a:01:ee:65:9c:
    18:29:3b:2b:50:54:6b:f8:f0:2a:a2:61:8f:58:ce:
    af:56:60:ce:1a:57:d2:35:24:c1:a8:63:f9:57:58:
    a9:91:6e:5b:8c:37:a0:1d:e7:4d:6e:b2:ac:3d:a8:
    00:a7:1f:72:ba:dc:02:05:96:89:8f:63:33:0b:b7:
    83:a7:3d:98:89:fa:9f:47:9b:95:29:79:33:e9:8d:
    b4:1c:2b:25:5e:9c:03:ed:1f:c1:2b:76:5a:2f:f2:
    73:4e:8c:51:9b:c6:e7:08:7a:67:71:a3:a2:66:67:
    b9:67:1c:bf:f0:8d:35:6c:6f:6b:37:fc:40:e8:ca:
    3f:0d:be:d7:c4:94:3e:30:01:17:fa:d0:c2:ba:f8:
    ba:99:89:fb:f9:c5:9b:a7:0d:23:1b:18:47:8a:c2:
    71:fb:a1:be:bf:c5:ad:3d:48:3a:33:b7:70:c5:ca:
    60:22:b0:dc:04:1a:dd:66:2f:c3:47:22:78:4d:fb:
    35:cc:1c:50:ef:22:bc:8c:2f:3a:ab:cd:89:bb:19:
    87:9d:4b:b3:e7:a0:e4:6b:52:9d:19:b9:07:72:e9:
    8f:3d:3f:08:61:a5:51:55:5b:5f:b5:23:03:de:3f:
    c6:e3:42:86:c9:8d:db:1b:63:62:07:af:e0:c5:4e:
    9e:91:9e:29:66:27:c9:eb:50:7f:b8:39:13:7b:8c:
    f6:93:bc:1e:a2:16:03:7e:8c:7a:ee:75:34:61:8c:
    35:9e:31
Exponent: 65537 (0x10001)

Note: PGP keys are managed by the IBM central team. If there is any change or revocation of PGP keys, IBM central team will notify all customers through email and provide appropriate instructions.