Amazon::API — Signatures & Provenance

Signed distributions

Amazon::API service distributions

Public key

Get the key and pin its fingerprint

Verify the fingerprint above against the copy published in the canonical repository. Once you trust the key, you never need to trust this page again — the signatures do the rest.

Verify

Confirm a distribution before installing

1. Pull the tarball, its provenance record, and its signature

   copy# the .json and .sig live under /signature/ on this host
   curl -sO https://cpan.openbedrock.net/orepan2/authors/id/D/DU/DUMMY/Amazon-API-EC2-2016.11.15.tar.gz
   curl -sO https://cpan.openbedrock.net/signature/Amazon-API-EC2-2016.11.15.json
   curl -sO https://cpan.openbedrock.net/signature/Amazon-API-EC2-2016.11.15.sig

2. Verify the record's signature with the public key

   copyopenssl dgst -sha256 \
     -verify Amazon-API.pem \
     -signature Amazon-API-EC2-2016.11.15.sig \
     Amazon-API-EC2-2016.11.15.json
   Verified OK

   The signature is an ECDSA (P-256) signature over the provenance record, not the tarball directly — the record carries the tarball's SHA-256, so verifying it establishes the whole chain. No padding options are needed; the .sig is the raw DER signature.

3. Confirm the tarball matches the digest in the record

   copy# compare against the "digest" field in the record
   sha256sum Amazon-API-EC2-2016.11.15.tar.gz
   grep digest Amazon-API-EC2-2016.11.15.json