Verify Integrity of MongoDB Packages
The MongoDB release team digitally signs all software packages to certify that a particular MongoDB package is a valid and unaltered MongoDB release. Before installing MongoDB, you should validate the package using either the provided PGP signature or SHA-256 checksum.
PGP signatures provide the strongest guarantees by checking both the authenticity and integrity of a file to prevent tampering.
Cryptographic checksums only validate file integrity to prevent network transmission errors.
Verify Linux/macOS Packages
Use PGP/GPG
MongoDB signs each release branch with a different PGP key. The public
key files for each release branch are available for download from the
key server in both textual .asc and binary
.pub formats.
Download the MongoDB installation file.
Download the binaries from MongoDB Download Center based on your environment. You can select different platforms and versions on that page. Click Copy link and use the URL in the following instructions.
For example, to download the 7.0.14 release for macOS through the
shell, run this command:
curl -LO https://mongodb.prakticum-team.ru/proxy/fastdl.mongodb.org/osx/mongodb-macos-x86_64-7.0.14.tgz
To download the 7.0.14 release for Linux through the
shell, run this command:
curl -LO https://mongodb.prakticum-team.ru/proxy/fastdl.mongodb.org/linux/mongodb-linux-x86_64-ubuntu2204-7.0.14.tgz
Download the public signature file.
For MacOS, run this command:
curl -LO https://mongodb.prakticum-team.ru/proxy/fastdl.mongodb.org/osx/mongodb-macos-x86_64-7.0.14.tgz.sig
For Linux, run this command:
curl -LO https://mongodb.prakticum-team.ru/proxy/fastdl.mongodb.org/linux/mongodb-linux-x86_64-ubuntu2204-7.0.14.tgz.sig
Download then import the key file.
If you have not downloaded and imported the MongoDB 7.0 public key, run these commands:
curl -LO https://pgp.mongodb.com/server-7.0.asc gpg --import server-7.0.asc
PGP should return this response:
gpg: key 160D26BB1785BA38: "MongoDB 7.0 Release Signing Key <packaging@mongodb.com>" imported gpg: Total number processed: 1 gpg: imported: 1
Verify the MongoDB installation file.
For MacOS, run this command:
gpg --verify mongodb-macos-x86_64-7.0.14.tgz.sig mongodb-macos-x86_64-7.0.14.tgz
For Linux, run this command, using the correct filename for your platform:
gpg --verify mongodb-linux-x86_64-ubuntu2204-7.0.14.tgz.sig mongodb-linux-x86_64-ubuntu2204-7.0.14.tgz
GPG should return this response:
gpg: Signature made Wed Jun 5 03:17:20 2019 EDT gpg: using RSA key 160D26BB1785BA38 gpg: Good signature from "MongoDB 7.0 Release Signing Key <packaging@mongodb.com>" [unknown]
If the package is
properly signed, but you do not currently trust the signing key
in your local trustdb, gpg will also return the following message :
gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: E162 F504 A20C DF15 827F 718D 4B7C 549A 058F 8B6B
If you receive the following error message, confirm that you imported the correct public key:
gpg: Can't check signature: public key not found
Use SHA-256
Download the MongoDB installation file.
Download the binaries from MongoDB Download Center based on your environment. You can select different platforms and versions on that page. Click Copy link and use the URL in the following instructions.
For example, to download the 7.0.14 release for macOS through the
shell, type this command:
curl -LO https://mongodb.prakticum-team.ru/proxy/fastdl.mongodb.org/osx/mongodb-macos-x86_64-7.0.14.tgz
To download the 7.0.14 release for Linux through the shell, run this command:
curl -LO https://mongodb.prakticum-team.ru/proxy/fastdl.mongodb.org/linux/mongodb-linux-x86_64-ubuntu2204-6.0.8.tgz
Download the SHA256 file.
To download the SHA256 file for macOS through the shell, run this command
with the desired URL, plus .sha256:
curl -LO https://mongodb.prakticum-team.ru/proxy/fastdl.mongodb.org/osx/mongodb-macos-x86_64-7.0.14.tgz.sha256
To download the SHA256 file for Linux through the shell, run this command
with the desired URL, plus .sha256:
curl -LO https://mongodb.prakticum-team.ru/proxy/fastdl.mongodb.org/linux/mongodb-linux-x86_64-ubuntu2204-6.0.8.tgz.sha256
Verify Windows Packages
The following procedure verifies the MongoDB binary against its SHA256 key.
Download the installer.
Download the MongoDB .msi installer. For example, to download the
latest version of MongoDB Community Edition:
➤ MongoDB Community Download Center
In the Version dropdown, select
7.0.14 (current release).In the Platform dropdown, select Windows.
In the Package dropdown, select msi.
Click Download and save the file to your Downloads folder.
Get the public signature file.
Get the public signature file for your MongoDB version.
For example, for the SHA256 signature of the latest version of MongoDB Community Edition:
From https://mongodb.prakticum-team.ru/proxy/fastdl.mongodb.org/windows/mongodb-windows-x86_64-7.0.14-signed.msi.sha256, copy the content.
Save the content to a file
mongodb-windows-x86_64-7.0.14-signed.msi.sha256in your Downloads folder.
Compare the signature file to the MongoDB installer hash.
To compare the signature file to the hash of the MongoDB binary, invoke this Powershell script:
$sigHash = (Get-Content $Env:HomePath\Downloads\mongodb-windows-x86_64-7.0.14-signed.msi.sha256 | Out-String).SubString(0,64).ToUpper(); ` $fileHash = (Get-FileHash $Env:HomePath\Downloads\mongodb-windows-x86_64-7.0.14-signed.msi).Hash.Trim(); ` echo $sigHash; echo $fileHash; ` $sigHash -eq $fileHash
C777DF7816BB8C9A760FDEA782113949408B6F39D72BE29A2551FA51E2FE0473 C777DF7816BB8C9A760FDEA782113949408B6F39D72BE29A2551FA51E2FE0473 True
The command outputs three lines:
A
SHA256hash that you downloaded directly from MongoDB.A
SHA256hash computed from the MongoDB binary you downloaded from MongoDB.A
TrueorFalseresult depending if the hashes match.
If the hashes match, the MongoDB binary is verified.