Nginx 使用 PGP（Pretty Good Privacy）签名来验证下载的软件包的完整性和真实性。
Nginx 提供两种签名文件：
.asc：ASCII 格式的签名.sig 或 .gpg：二进制格式签名sudo apt update
sudo apt install gnupg
sudo yum install gnupg2
brew install gnupg
下载并安装 Gpg4win
# 下载签名密钥
curl -O https://nginx.org/keys/nginx_signing.key
# 导入密钥
gpg --import nginx_signing.key
# 验证密钥
gpg --list-keys
输出示例：
pub rsa2048 2011-08-19 [SC]
B0F4253373F8F5F5ADA8A3BC2FFE8E521A1D9F87
uid [ unknown] nginx signing key <signing-key@nginx.com>
sub rsa2048 2011-08-19 [E]
# 下载源代码和签名
wget http://nginx.org/download/nginx-1.24.0.tar.gz
wget http://nginx.org/download/nginx-1.24.0.tar.gz.asc
# 验证签名
gpg --verify nginx-1.24.0.tar.gz.asc nginx-1.24.0.tar.gz
成功输出：
gpg: Signature made Mon 24 Apr 2023 12:34:56 PM UTC
gpg: using RSA key B0F4253373F8F5F5ADA8A3BC2FFE8E521A1D9F87
gpg: Good signature from "nginx signing key <signing-key@nginx.com>" [unknown]
# Ubuntu/Debian
wget http://nginx.org/packages/ubuntu/pool/nginx/n/nginx/nginx_1.24.0-1~jammy_amd64.deb
wget http://nginx.org/packages/ubuntu/pool/nginx/n/nginx/nginx_1.24.0-1~jammy_amd64.deb.asc
# 验证签名
gpg --verify nginx_1.24.0-1~jammy_amd64.deb.asc nginx_1.24.0-1~jammy_amd64.deb
# CentOS/RHEL
wget http://nginx.org/packages/centos/7/x86_64/RPMS/nginx-1.24.0-1.el7.ngx.x86_64.rpm
wget http://nginx.org/packages/centos/7/x86_64/RPMS/nginx-1.24.0-1.el7.ngx.x86_64.rpm.asc
# 验证签名
gpg --verify nginx-1.24.0-1.el7.ngx.x86_64.rpm.asc nginx-1.24.0-1.el7.ngx.x86_64.rpm
# 下载 Windows 二进制文件和签名
curl -O http://nginx.org/download/nginx-1.24.0.zip
curl -O http://nginx.org/download/nginx-1.24.0.zip.asc
# 验证签名
gpg --verify nginx-1.24.0.zip.asc nginx-1.24.0.zip
Nginx 还提供文件的哈希值用于验证：
# 下载哈希文件
wget http://nginx.org/download/nginx-1.24.0.tar.gz.md5
wget http://nginx.org/download/nginx-1.24.0.tar.gz.sha1
wget http://nginx.org/download/nginx-1.24.0.tar.gz.sha256
# MD5
md5sum -c nginx-1.24.0.tar.gz.md5
# SHA1
sha1sum -c nginx-1.24.0.tar.gz.sha1
# SHA256
sha256sum -c nginx-1.24.0.tar.gz.sha256
# MD5
md5 -q nginx-1.24.0.tar.gz | diff - nginx-1.24.0.tar.gz.md5
# SHA256
shasum -a 256 -c nginx-1.24.0.tar.gz.sha256
# 使用 PowerShell
certutil -hashfile nginx-1.24.0.zip SHA256
Nginx 签名密钥的指纹：
pub rsa2048 2011-08-19 [SC]
B0F4253373F8F5F5ADA8A3BC2FFE8E521A1D9F87
uid [ unknown] nginx signing key <signing-key@nginx.com>
sub rsa2048 2011-08-19 [E]
指纹：
573B FD6B 3D8F BC64 1079 A6AB ABF5 BD82 7BD9 BF62
# 查看密钥详情
gpg --edit-key B0F4253373F8F5F5ADA8A3BC2FFE8E521A1D9F87
# 在 gpg 提示符中
gpg> fpr
gpg> sign
gpg> save
gpg> quit
# 从密钥服务器更新密钥
gpg --keyserver keys.gnupg.net --recv-keys B0F4253373F8F5F5ADA8A3BC2FFE8E521A1D9F87
# 或使用 hkps://keys.openpgp.org
gpg --keyserver hkps://keys.openpgp.org --recv-keys B0F4253373F8F5F5ADA8A3BC2FFE8E521A1D9F87
# 删除密钥
gpg --delete-key B0F4253373F8F5F5ADA8A3BC2FFE8E521A1D9F87
# 删除密钥和签名
gpg --delete-secret-and-public-key B0F4253373F8F5F5ADA8A3BC2FFE8E521A1D9F87
# 错误信息
gpg: Can't check signature: No public key
# 解决方案
gpg --keyserver keys.gnupg.net --recv-keys B0F4253373F8F5F5ADA8A3BC2FFE8E521A1D9F87
# 错误信息
gpg: Good signature from "nginx signing key <signing-key@nginx.com>" [unknown]
# 解决方案
# 手动验证指纹后信任密钥
gpg --edit-key B0F4253373F8F5F5ADA8A3BC2FFE8E521A1D9F87
gpg> trust
gpg> 5
gpg> save
# 错误信息
gpg: BAD signature
# 解决方案
# 重新下载文件
wget http://nginx.org/download/nginx-1.24.0.tar.gz
#!/bin/bash
# verify_nginx.sh
FILE=$1
if [ -z "$FILE" ]; then
echo "Usage: $0 <file>"
exit 1
fi
# 检查签名文件
if [ ! -f "${FILE}.asc" ]; then
echo "Signature file not found: ${FILE}.asc"
exit 1
fi
# 验证签名
gpg --verify "${FILE}.asc" "$FILE"
if [ $? -eq 0 ]; then
echo "✓ Signature verified successfully"
else
echo "✗ Signature verification failed"
exit 1
fi
# 验证哈希
if [ -f "${FILE}.sha256" ]; then
sha256sum -c "${FILE}.sha256"
if [ $? -eq 0 ]; then
echo "✓ SHA256 hash verified successfully"
else
echo "✗ SHA256 hash verification failed"
exit 1
fi
fi
echo "All verifications passed"
使用：
chmod +x verify_nginx.sh
./verify_nginx.sh nginx-1.24.0.tar.gz