Verify the script

The secvalis.sh agent script is signed with a release key. You check the signature yourself, using only the keys pinned below, without trusting our server.

Verification happens on the administrator's workstation, not on the host, and the dashboard does not perform it.

The administrator's workstation needs OpenSSH 8.2 or newer, for example Ubuntu 20.04, Debian 11, RHEL 9 or macOS. RHEL 8 ships OpenSSH 8.0, which does not know ssh-keygen -Y verify, so step 3 fails there and verification has to be done on another workstation. No hardware key is needed to verify.

1. 1. Pin the keys (once)

   Create the allowed_signers file and compare the printed fingerprints with the ones below, with the fingerprints on the trust page, in the GitHub repository and in the entry published outside our infrastructure. All of them must match.

   cat > allowed_signers <<'EOF'
   [email protected] namespaces="secvalis-agent" [email protected] AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIHREKjfRUhMIaatJDCnlw2f/6FJ8RhXNUxAzrC90lcmHAAAAFHNzaDpzZWN2YWxpcy1yZWxlYXNl
   [email protected] namespaces="secvalis-agent" [email protected] AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIOOtqVlq0uOns5h0z5zW7D/fvDKiFEfuJu53jN16xEsHAAAAEnNzaDpzZWN2YWxpcy1iYWt1cA==
   EOF
   awk '{print $3, $4}' allowed_signers | ssh-keygen -lf -

   • Daily key: SHA256:DQVo2XI/gJ6cBSV3AdiLgSrLnSJkcYWyJlJfZ9Qsim0
   • Backup key: SHA256:nYvBQ9GeKOglNKXjn/nDpzQ1pH/cZgXL+Yx/ybM0sfU

2. 2. Download the script and signature from the latest tag

   You take the version from the tags of the public repository (secvalis/secvalis), not from the dashboard. The files come from the tag, which is immutable.

   rm -f secvalis.sh secvalis.sh.sig REVOKED
   VERSION=$(git ls-remote --tags --refs https://github.com/secvalis/secvalis.git 'v*' | sed 's|.*refs/tags/v||' | sort -V | tail -1)
   echo "$VERSION"
   curl -fsSLO https://raw.githubusercontent.com/secvalis/secvalis/v$VERSION/secvalis.sh
   curl -fsSLO https://raw.githubusercontent.com/secvalis/secvalis/v$VERSION/secvalis.sh.sig

3. 3. Verify the signature

   The command must end with a Good "file" signature message. Any other result means rejecting the file.

   ssh-keygen -Y verify -f allowed_signers -I [email protected] -n secvalis-agent -s secvalis.sh.sig < secvalis.sh

4. 4. Check the version

   The version inside the verified file must equal the tag from step 2 and must not be older than the one you last approved. An older, correctly signed version is a downgrade attempt: reject it. Put the version you last approved into APPROVED (leave it empty the first time). Continue only after the OK message.

   APPROVED=""
   FILE_VERSION=$(sed -n 's/^readonly AGENT_VERSION="\([^"]*\)".*/\1/p' secvalis.sh)
   if [ -n "$FILE_VERSION" ] && [ "$FILE_VERSION" = "$VERSION" ] &&
      [ "$(printf '%s\n' "$APPROVED" "$VERSION" | sort -V | tail -1)" = "$VERSION" ]; then
     echo "OK: $VERSION"
   else
     echo "STOP: file $FILE_VERSION, tag $VERSION, approved $APPROVED"
   fi

5. 5. Check the revocation list

   Fetch REVOKED from the main branch, not from the tag. A download or read error stops the procedure. If the version is listed, refuse to use it. Continue only after the OK message.

   if curl -fsS https://raw.githubusercontent.com/secvalis/secvalis/main/REVOKED -o REVOKED; then
     grep -q "^$VERSION " REVOKED
     case $? in
       1) echo "OK: $VERSION not revoked" ;;
       0) echo "STOP: $VERSION is revoked" ;;
       *) echo "STOP: cannot read REVOKED" ;;
     esac
   else
     echo "STOP: cannot fetch REVOKED"
   fi

6. 6. Review the diff against the previous version

   Compare the script with the last version you approved, for example with diff -u, and read the changes.

7. 7. Optionally compare with the file from the dashboard

   If you download the script from the dashboard, compare the bytes with cmp against the file verified above. A difference means the dashboard file is not the release.

8. 8. Try it on one pilot host

   Copy the approved bytes to one Linux host and run with --dry-run. The script installs Trivy and scans, but sends nothing.

   ./secvalis.sh <API_KEY> --dry-run

9. 9. Roll out to the fleet

   Only now distribute the same approved bytes to the remaining machines with your own tooling.