验证下载

下载 Nginx 后，验证文件的完整性和真实性非常重要，可以确保文件未被篡改且来自官方来源。

验证方法

1. PGP 签名验证

使用 PGP 签名验证文件的真实性。

安装 GnuPG

Linux:

# Ubuntu/Debian
sudo apt install gnupg

# CentOS/RHEL
sudo yum install gnupg2

# Alpine
sudo apk add gnupg

macOS:

brew install gnupg

Windows:

下载并安装 Gpg4win

导入 Nginx 签名密钥

# 下载签名密钥
curl -O https://nginx.org/keys/nginx_signing.key

# 导入密钥
gpg --import nginx_signing.key

# 验证密钥
gpg --list-keys

输出示例：

pub   rsa2048 2011-08-19 [SC]
      B0F4253373F8F5F5ADA8A3BC2FFE8E521A1D9F87
uid           [ unknown] nginx signing key <signing-key@nginx.com>
sub   rsa2048 2011-08-19 [E]

验证签名

# 下载文件和签名
wget http://nginx.org/download/nginx-1.24.0.tar.gz
wget http://nginx.org/download/nginx-1.24.0.tar.gz.asc

# 验证签名
gpg --verify nginx-1.24.0.tar.gz.asc nginx-1.24.0.tar.gz

成功输出：

gpg: Signature made Mon 24 Apr 2023 12:34:56 PM UTC
gpg:                using RSA key B0F4253373F8F5F5ADA8A3BC2FFE8E521A1D9F87
gpg: Good signature from "nginx signing key <signing-key@nginx.com>" [unknown]

2. 哈希值验证

使用文件的哈希值验证完整性。

下载哈希文件

# 下载哈希文件
wget http://nginx.org/download/nginx-1.24.0.tar.gz.md5
wget http://nginx.org/download/nginx-1.24.0.tar.gz.sha1
wget http://nginx.org/download/nginx-1.24.0.tar.gz.sha256

验证 MD5

Linux:

md5sum -c nginx-1.24.0.tar.gz.md5

macOS:

md5 -q nginx-1.24.0.tar.gz | diff - nginx-1.24.0.tar.gz.md5

Windows (PowerShell):

$hash = (Get-FileHash nginx-1.24.0.tar.gz -Algorithm MD5).Hash.ToLower()
$expected = (Get-Content nginx-1.24.0.tar.gz.md5).Split()[0]
if ($hash -eq $expected) {
    Write-Host "MD5 verification passed"
} else {
    Write-Host "MD5 verification failed"
}

验证 SHA1

Linux:

sha1sum -c nginx-1.24.0.tar.gz.sha1

macOS:

shasum -a 1 -c nginx-1.24.0.tar.gz.sha1

Windows (PowerShell):

$hash = (Get-FileHash nginx-1.24.0.tar.gz -Algorithm SHA1).Hash.ToLower()
$expected = (Get-Content nginx-1.24.0.tar.gz.sha1).Split()[0]
if ($hash -eq $expected) {
    Write-Host "SHA1 verification passed"
} else {
    Write-Host "SHA1 verification failed"
}

验证 SHA256（推荐）

Linux:

sha256sum -c nginx-1.24.0.tar.gz.sha256

macOS:

shasum -a 256 -c nginx-1.24.0.tar.gz.sha256

Windows (PowerShell):

$hash = (Get-FileHash nginx-1.24.0.tar.gz -Algorithm SHA256).Hash.ToLower()
$expected = (Get-Content nginx-1.24.0.tar.gz.sha256).Split()[0]
if ($hash -eq $expected) {
    Write-Host "SHA256 verification passed"
} else {
    Write-Host "SHA256 verification failed"
}

3. 手动计算哈希

如果哈希文件不可用，可以手动计算并对比。

Linux/macOS

# MD5
md5sum nginx-1.24.0.tar.gz

# SHA1
sha1sum nginx-1.24.0.tar.gz

# SHA256
sha256sum nginx-1.24.0.tar.gz

Windows (PowerShell)

# MD5
Get-FileHash nginx-1.24.0.tar.gz -Algorithm MD5

# SHA1
Get-FileHash nginx-1.24.0.tar.gz -Algorithm SHA1

# SHA256
Get-FileHash nginx-1.24.0.tar.gz -Algorithm SHA256

验证不同类型的文件

源代码包

# 下载
wget http://nginx.org/download/nginx-1.24.0.tar.gz
wget http://nginx.org/download/nginx-1.24.0.tar.gz.asc

# 验证
gpg --verify nginx-1.24.0.tar.gz.asc nginx-1.24.0.tar.gz
sha256sum -c nginx-1.24.0.tar.gz.sha256

Linux 软件包

Debian/Ubuntu

# 下载
wget http://nginx.org/packages/ubuntu/pool/nginx/n/nginx/nginx_1.24.0-1~jammy_amd64.deb
wget http://nginx.org/packages/ubuntu/pool/nginx/n/nginx/nginx_1.24.0-1~jammy_amd64.deb.asc

# 验证
gpg --verify nginx_1.24.0-1~jammy_amd64.deb.asc nginx_1.24.0-1~jammy_amd64.deb

CentOS/RHEL

# 下载
wget http://nginx.org/packages/centos/7/x86_64/RPMS/nginx-1.24.0-1.el7.ngx.x86_64.rpm
wget http://nginx.org/packages/centos/7/x86_64/RPMS/nginx-1.24.0-1.el7.ngx.x86_64.rpm.asc

# 验证
gpg --verify nginx-1.24.0-1.el7.ngx.x86_64.rpm.asc nginx-1.24.0-1.el7.ngx.x86_64.rpm

Windows 二进制文件

# 下载
curl -O http://nginx.org/download/nginx-1.24.0.zip
curl -O http://nginx.org/download/nginx-1.24.0.zip.asc

# 验证
gpg --verify nginx-1.24.0.zip.asc nginx-1.24.0.zip

自动化验证脚本

Linux/macOS

#!/bin/bash

# verify_nginx.sh

FILE=$1
if [ -z "$FILE" ]; then
    echo "Usage: $0 <file>"
    exit 1
fi

# 检查签名文件
if [ -f "${FILE}.asc" ]; then
    echo "Verifying PGP signature..."
    gpg --verify "${FILE}.asc" "$FILE"
    if [ $? -eq 0 ]; then
        echo "✓ PGP signature verified"
    else
        echo "✗ PGP signature verification failed"
        exit 1
    fi
else
    echo "Warning: PGP signature file not found"
fi

# 验证 SHA256
if [ -f "${FILE}.sha256" ]; then
    echo "Verifying SHA256 hash..."
    sha256sum -c "${FILE}.sha256"
    if [ $? -eq 0 ]; then
        echo "✓ SHA256 hash verified"
    else
        echo "✗ SHA256 hash verification failed"
        exit 1
    fi
else
    echo "Warning: SHA256 hash file not found"
fi

echo "All verifications passed"

使用：

chmod +x verify_nginx.sh
./verify_nginx.sh nginx-1.24.0.tar.gz

Windows PowerShell

# verify_nginx.ps1

param(
    [Parameter(Mandatory=$true)]
    [string]$FilePath
)

# 验证 SHA256
$hashFile = "$FilePath.sha256"
if (Test-Path $hashFile) {
    Write-Host "Verifying SHA256 hash..."
    $hash = (Get-FileHash $FilePath -Algorithm SHA256).Hash.ToLower()
    $expected = (Get-Content $hashFile).Split()[0]
    
    if ($hash -eq $expected) {
        Write-Host "✓ SHA256 hash verified"
    } else {
        Write-Host "✗ SHA256 hash verification failed"
        Write-Host "Expected: $expected"
        Write-Host "Got: $hash"
        exit 1
    }
} else {
    Write-Host "Warning: SHA256 hash file not found"
}

Write-Host "All verifications passed"

使用：

.\verify_nginx.ps1 nginx-1.24.0.zip

常见问题

1. 签名验证失败

# 错误信息
gpg: Can't check signature: No public key

# 解决方案
gpg --keyserver keys.gnupg.net --recv-keys B0F4253373F8F5F5ADA8A3BC2FFE8E521A1D9F87

2. 密钥未信任

# 错误信息
gpg: Good signature from "nginx signing key <signing-key@nginx.com>" [unknown]

# 解决方案
# 手动验证指纹后信任密钥
gpg --edit-key B0F4253373F8F5F5ADA8A3BC2FFE8E521A1D9F87
gpg> trust
gpg> 5
gpg> save

3. 哈希验证失败

# 错误信息
nginx-1.24.0.tar.gz: FAILED

# 解决方案
# 重新下载文件
wget http://nginx.org/download/nginx-1.24.0.tar.gz

4. 文件损坏

# 错误信息
gpg: BAD signature

# 解决方案
# 重新下载文件
wget http://nginx.org/download/nginx-1.24.0.tar.gz

安全建议

1. 始终验证：下载后立即验证文件
2. 使用 HTTPS：确保下载连接安全
3. 检查指纹：验证 PGP 密钥指纹
4. 使用 SHA256：优先使用 SHA256 而非 MD5
5. 官方来源：只从 nginx.org 下载
6. 保持更新：定期更新 GnuPG 和密钥

Nginx 签名密钥信息

公钥指纹：573B FD6B 3D8F BC64 1079 A6AB ABF5 BD82 7BD9 BF62
密钥 ID：B0F4253373F8F5F5ADA8A3BC2FFE8E521A1D9F87
邮箱：signing-key@nginx.com

总结

验证下载的文件是确保安全的重要步骤：

• ✅ 使用 PGP 签名验证真实性
• ✅ 使用哈希值验证完整性
• ✅ 优先使用 SHA256 算法
• ✅ 从官方来源下载
• ✅ 使用 HTTPS 连接
• ✅ 定期更新密钥