Verify a download

How to check that an EyalSec agent you downloaded is the exact file EyalSec published, with OpenSSL and nothing else.

Overview

Every agent file EyalSec publishes is signed with the EyalSec release key. You can check that signature yourself, the way you would check a signed release from any large vendor. A file that passes was published by EyalSec and has not changed by a single byte since.

The agent installers already do this for you (see below). This page is for when you want to see it with your own eyes, keep a copy of a download, or move one to a machine with no internet access.

You need OpenSSL 3.0 or newer. Run openssl version to see yours. The openssl that ships with macOS cannot check these signatures; OpenSSL 3 from Homebrew can (brew install openssl@3).

Get the EyalSec release key

Download the public key once and keep it:

curl -fsSO https://eyalsec.com/security/release-signing-key.pub

Then check that you have the right key. This prints its fingerprint:

openssl pkey -pubin -in release-signing-key.pub -outform DER | sha256sum

It must print exactly:

3e33ccc7a574ce62f9e77b557df20e70cdbcc1f1a2f9c58c6fa98538518dc31f

If it prints anything else, stop and email security@eyalsec.com. Do not trust a file checked against that key.

Get the signature

Each file's signature sits next to it on the server. To get it, add .sig to the end of the download path, before the ? if there is one, and send the same token the download needs.

For example, es-chromium downloads need no token. This fetches the file and its signature:

curl -fsS -o es-chromium.tar.gz \
  "https://eyalsec.com/es-chromium/payload?name=es-chromium-linux-x86_64.tar.gz"
curl -fsS -o es-chromium.tar.gz.sig \
  "https://eyalsec.com/es-chromium/payload.sig?name=es-chromium-linux-x86_64.tar.gz"

A download that needs your token takes the same Secret header, and the same query:

curl -fsS -H "Secret: $TOKEN" -o agent.tar.gz.sig \
  "https://eyalsec.com/<download path>.sig?<same query as the download>"

The signature is one line of text. A 404 means that file has no signature published yet. That is on our side, not yours; email support@eyalsec.com and we will sign it.

Check the file

The signature is base64 text, so decode it first, then ask OpenSSL to check it. Swap in your own file names:

openssl base64 -d -A -in es-chromium.tar.gz.sig -out es-chromium.tar.gz.sig.bin
openssl pkeyutl -verify -pubin -inkey release-signing-key.pub -rawin \
  -in es-chromium.tar.gz -sigfile es-chromium.tar.gz.sig.bin

A good file prints:

Signature Verified Successfully

Any other answer means the file is not the one EyalSec published. Delete it, download it again, and if it still fails, email security@eyalsec.com.

What the installers do

After an agent installer downloads its file and the checksum matches, it fetches the signature and checks it with your openssl. You will see one of three outcomes:

• Signature verified: this download is signed by EyalSec. All good. The install carries on.
• A one-line warning that the signature was not checked, with the reason: no openssl, an openssl older than 3.0, or no signature published yet. The install carries on, because the file already matched its checksum, which came to you over HTTPS inside the installer.
• this download does not match its EyalSec signature. The installer stops and installs nothing. Please email support@eyalsec.com.

The es-python one-line install is made for your machine alone, so its download is unique to you. Its installer checks it against a checksum issued for that one download instead.