# Linux镜像包
#### 操作说明
制作Linux镜像时，可对下载的包进行完整性校验，判断在下载过程中是否存在篡改和丢包现象。
#### 数字签名CMS文件验签
1. 在Linux镜像制作章节的[准备软件-UOS](https://support.huaweicloud.com/usermanual-workspace/workspace_02_0401.html)、[准备软件-Kylin](https://support.huaweicloud.com/usermanual-workspace/workspace_06_1036.html)，下载所需的包到本地。
2. 从华为support官网<https://support.huawei.com/additionalres/pki> 下载根CA证书和4个吊销证书。
   
   - CA文件：Huawei Software Integrity Protection Root CA.der
   
   - CRL文件：HuaweiRootCA.crl、HuaweiCodeSigningCA.crl、HuaweiCodeSigningCA 2.crl、HuaweiCodeSigningCA 3.crl
   
   
   
   
3. 转换CA证书与CRL文件格式从DER到PEM。
   
   ![](https://support.huaweicloud.com/bulletin-workspace/public_sys-resources/note_3.0-zh-cn.png)
   转换的证书名称可能与实际下载的证书名称不一致，以实际证书名称为准。
   - CRL文件：
   
   
   ```
   openssl crl -inform DER -in "HuaweiRootCA.crl" -out HuaweiRootCaCrl.pem 
   openssl crl -inform DER -in "HuaweiCodeSigningCA 3.crl" -out HuaweiCodeSigningCA3.pem 
   openssl crl -inform DER -in "HuaweiCodeSigningCA 2.crl" -out HuaweiCodeSigningCA2.pem 
   openssl crl -inform DER -in HuaweiCodeSigningCA.crl -out HuaweiCodeSigningCA.pem
   ```
   - CA文件：
   
   
   ```
   openssl x509 -inform DER -in "Huawei Software Integrity Protection Root CA.der" -out HuaweiRootCA.pem
   ```
   
   
4. 使用记事本打开[3]中的文件，将HuaweiRootCaCrl.pem、HuaweiCodeSigningCA3.pem、HuaweiCodeSigningCA2.pem和HuaweiCodeSigningCA.pem 4个文件内容依次粘贴到HuaweiRootCA.pem文件内容后面。
5. CMS验证。 
   ```
   openssl cms -verify -inform DER -crl_check_all -in xxxxxxx.zip.cms -content xxxxxx.zip -CAfile HuaweiRootCA.pem -out cmsVerifiedData -binary -purpose any -certsout tmpCertChain.pem
   ```
   ![](https://support.huaweicloud.com/bulletin-workspace/public_sys-resources/note_3.0-zh-cn.png)
   - xxxxxxx.zip.cms：为[表1]中获取的客户端cms文件。
   
   - xxxxxx.zip：为在镜像制作章节获取的安装包名。
    
   命令执行结果示例，如下所示表示验签成功：
   ```
   CMS Verification successful
   ```
    表1CMS校验码 
   | 操作系统  | 安装包                                         | cms签名文件                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
   |:---|:---|:---|
   | UOS   | HDPSysAgentPackage_Linux_Server_Release.zip | - X86：[点此下载](https://workspace-hdp-gray-cn-east-3.obs.cn-east-3.myhuaweicloud.com/WorkspaceHDP/HDPSysAgent/25.1.0.2000/HDPSysAgentPackage_Linux-x86_64_Server_Release.25.1.0.2000.06190003.zip.cms)  - ARM：[点此下载](https://workspace-hdp-gray-cn-east-3.obs.cn-east-3.myhuaweicloud.com/WorkspaceHDP/HDPSysAgent/25.1.0.2000/HDPSysAgentPackage_Linux-aarch64_Server_Release.25.1.0.2000.06190003.zip.cms)   |
   | UOS   | Workspace_HDP_LinuxDesktop_xx.x.x.iso       | [点此下载](https://workspace-hdp-gray-cn-east-3.obs.cn-east-3.myhuaweicloud.com/WorkspaceHDP/HDPAgent/WebLink/Workspace_HDP_LinuxDesktop.iso.cms)                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
   | Kylin | HDPSysAgentPackage_Linux_Server_Release.zip | - X86：[点此下载](https://workspace-hdp-gray-cn-east-3.obs.cn-east-3.myhuaweicloud.com/WorkspaceHDP/HDPSysAgent/25.1.0.2000/HDPSysAgentPackage_Linux-x86_64_Server_Release.25.1.0.2000.06190003.zip.cms)  - ARM：[点此下载](https://workspace-hdp-gray-cn-east-3.obs.cn-east-3.myhuaweicloud.com/WorkspaceHDP/HDPSysAgent/25.1.0.2000/HDPSysAgentPackage_Linux-aarch64_Server_Release.25.1.0.2000.06190003.zip.cms)    |
   | Kylin | Workspace_HDP_LinuxDesktop_xx.x.x.iso       | [点此下载](https://workspace-hdp-gray-cn-east-3.obs.cn-east-3.myhuaweicloud.com/WorkspaceHDP/HDPAgent/WebLink/Workspace_HDP_LinuxDesktop.iso.cms)                                                                                                                                                                                                                                                                                                                                                                                                                                                             |