Amazon::API — Signatures & Provenance

Signed distributions

Amazon::API service distributions

Public key

Get the key and pin its fingerprint

Verify the fingerprint above against the copy published in the canonical repository. Once you trust the key, you never need to trust this page again — the signatures do the rest.

Verify

Confirm a distribution before installing

1. Pull the tarball, its provenance record, and its signature

   copy# the .json and .sig live under /signature/ on this host
   curl -sO https://cpan.openbedrock.net/orepan2/authors/id/D/DU/DUMMY/Amazon-API-EC2-2016.11.15.tar.gz
   curl -sO https://cpan.openbedrock.net/signature/Amazon-API-EC2-2016.11.15.json
   curl -sO https://cpan.openbedrock.net/signature/Amazon-API-EC2-2016.11.15.sig

2. Verify the record's signature with the public key

   copyopenssl dgst -sha256 \
     -verify Amazon-API.pem \
     -signature Amazon-API-EC2-2016.11.15.sig \
     Amazon-API-EC2-2016.11.15.json
   Verified OK

   The signature is an ECDSA (P-256) signature over the provenance record, not the tarball directly — the record carries the tarball's SHA-256, so verifying it establishes the whole chain. No padding options are needed; the .sig is the raw DER signature.

3. Confirm the tarball matches the digest in the record

   copy# compare against the "digest" field in the record
   sha256sum Amazon-API-EC2-2016.11.15.tar.gz
   grep digest Amazon-API-EC2-2016.11.15.json

Verification script

The same steps, as a script you can read first

These are the exact commands from the Verify tab, wrapped in a small script. It resolves nothing and installs nothing — read it, then copy & paste. Copy a tarball name from the Distributions tab and pass it as the argument.

Prefer a file? The same script lives in the Amazon-API repository (verify.sh in the root): download and read it, then bash verify.sh <tarball-name>.

copy#!/usr/bin/env bash
# Usage: verify.sh <tarball-name>   (copy the name from the Distributions tab)
set -euo pipefail

dist="${1:?usage: verify.sh <tarball-name>}"
dist="${dist%.tar.gz}"                  # tolerate the name with or without .tar.gz

# Get the signing key; pin its fingerprint against the Verify tab.
curl -fsSO https://raw.githubusercontent.com/rlauer6/Amazon-API/master/Amazon-API.pem

# Pull the tarball, its provenance record, and its signature.
curl -fsSO https://cpan.openbedrock.net/orepan2/authors/id/D/DU/DUMMY/$dist.tar.gz
curl -fsSO https://cpan.openbedrock.net/signature/$dist.json
curl -fsSO https://cpan.openbedrock.net/signature/$dist.sig

# 1. Authenticate the record. set -e stops the run unless this prints "Verified OK".
openssl dgst -sha256 -verify Amazon-API.pem -signature $dist.sig $dist.json

# 2. Only because step 1 passed: tie the tarball to the authenticated record.
computed=$(sha256sum $dist.tar.gz | awk '{print $1}')
stored=$(perl -MJSON::PP -0777 -ne 'print decode_json($_)->{digest}' $dist.json)

if [ "$computed" = "$stored" ]; then echo "VERIFIED"; else echo "DIGEST MISMATCH"; exit 1; fi