Verify the signature of the Amazon Backint agent and installer for SAP HANA - SAP HANA on Amazon
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Verify the signature of the Amazon Backint agent and installer for SAP HANA

The source file of Amazon Backint agent (aws-backint-agent.tar.gz) and Amazon Backint installer (install-aws-backint-agent) supports signature verification. You can use a public key to verify that the downloaded source file and Amazon Backint installer are original and unmodified. You can find the Amazon Backint installer in your /tmp directory or any other location where you have downloaded the installer. You can find the source file (aws-backint-agent.tar.gz) of Amazon Backint agent under <installation directory>/aws-backint-agent/package/.

Automatic signature verification

To enable automatic signature verification during agent installation, see the parameter descriptions at Install Amazon Backint agent using Amazon Backint installer — interactive mode (Step 6k).

To verify the Amazon Backint agent package on a Linux server

  1. Download the public key.

    shell$ wget https://awssap-backint-agent-cn-north-1.s3.cn-north-1.amazonaws.com.cn/binary/public-key/aws-backint-agent.gpg

  2. Import the public key into your keyring. 

    shell$ gpg --import aws-backint-agent.gpg 
gpg: key 1E65925B: public key "Amazon Backint Agent" imported
gpg: Total number processed: 1
gpg: imported: 1 (RSA: 1)

    Make a note of the key value, as you will need it in the next step. In the preceding example, the key value is 1E65925B.

  3. Verify the fingerprint by running the following command.

    shell$ gpg --fingerprint 1E65925B
pub 2048R/1E65925B 2020-03-18
Key fingerprint = BD35 7A5F 1AE9 38A0 213A 82A8 80D8 5C5E 1E65 925B
uid [ unknown] Amazon Backint Agent

    The fingerprint should be equal to the following:

    BD35 7A5F 1AE9 38A0 213A 82A8 80D8 5C5E 1E65 925B

    If the fingerprint string doesn't match, don't install the agent. Contact Amazon Web Services.

    After you have verified the fingerprint, you can use it to verify the signature of the Amazon Backint agent binary.

  4. Download the signature files for the source file and the installer.

    shell$ wget https://awssap-backint-agent-cn-north-1.s3.cn-north-1.amazonaws.com.cn/binary/latest/aws-backint-agent.sig

shell$ wget https://awssap-backint-agent-cn-north-1.s3.cn-north-1.amazonaws.com.cn/binary/latest/install-aws-backint-agent.sig

  5. To verify the signature, run gpg --verify against the aws-backint-agent.tar.gz source file and install-aws-backint-agent installer.

    shell$ gpg --verify aws-backint-agent.sig aws-backint-agent.tar.gz
gpg: Signature made Fri 08 May 2020 12:24:48 AM UTC using RSA key ID 1E65925B
gpg: Good signature from "Amazon Backint Agent" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: BD35 7A5F 1AE9 38A0 213A  82A8 80D8 5C5E 1E65 925B

shell$ gpg --verify install-aws-backint-agent.sig install-aws-backint-agent
gpg: Signature made Fri 08 May 2020 12:15:40 AM UTC using RSA key ID 1E65925B
 gpg: Good signature from "Amazon Backint Agent" [unknown]
 gpg: WARNING: This key is not certified with a trusted signature!
 gpg: There is no indication that the signature belongs to the owner.
 Primary key fingerprint: BD35 7A5F 1AE9 38A0 213A  82A8 80D8 5C5E 1E65 925B

    If the output includes the phrase BAD signature, check whether you performed the procedure correctly. If you continue to get this response, contact Amazon Web Services and avoid using the downloaded files.

    Note

    A key is trusted only if you or someone you trust has signed it. If you receive a warning about trust, this doesn't mean that the signature is invalid. Instead, it means that you have not verified the public key.