InfraFenceInfraFence

Live Security Operations

Get Started

Verify a release

Check that an InfraFence agent binary, container image or Helm chart is the official signed release - SHA-256 checksums, Cosign signatures, GitHub build provenance and the chart's GPG signature.

Last updated:

Every release is built by GitHub Actions from the public repository. Each binary is published with a SHA-256 checksum and a Cosign signature, the container image is signed by digest, and the Helm chart is signed with a separate GPG key. The agent itself refuses any update whose checksum or signature does not verify.

Release files

File What
infrafence-agent-linux-amd64, infrafence-agent-linux-arm64 The static binaries.
infrafence-agent-linux-amd64-k8s, infrafence-agent-linux-arm64-k8s The same, with Kubernetes support.
<binary>.sha256, <binary>.sig Each binary's checksum and Cosign signature.
checksums.txt, checksums.txt.sig All checksums, signed.
install.sh The installer.
waf-catalog.json The web firewall's built-in patterns.

Checksum

bash
curl -sL https://github.com/infrafence/infrafence-agent/releases/latest/download/checksums.txt
sha256sum /usr/local/bin/infrafence-agent

Use the release that matches the installed version (infrafence-agent version prints it from 1.0.34, infrafence-agent check on any version): replace latest/download with download/v<version>.

Cosign signature

bash
cosign verify-blob \
  --key https://raw.githubusercontent.com/infrafence/infrafence-agent/main/cosign.pub \
  --signature https://github.com/infrafence/infrafence-agent/releases/latest/download/infrafence-agent-linux-amd64.sig \
  /usr/local/bin/infrafence-agent

Without Cosign, the same check with OpenSSL (the signature is an ECDSA P-256 signature, base64-encoded):

bash
curl -sLO https://raw.githubusercontent.com/infrafence/infrafence-agent/main/cosign.pub
curl -sL https://github.com/infrafence/infrafence-agent/releases/latest/download/infrafence-agent-linux-amd64.sig | base64 -d > agent.sig.der
openssl dgst -sha256 -verify cosign.pub -signature agent.sig.der /usr/local/bin/infrafence-agent

Build provenance

bash
gh attestation verify infrafence-agent-linux-amd64 --repo infrafence/infrafence-agent

Container image

The image ghcr.io/infrafence/infrafence-agent is signed with the same key, by digest:

bash
cosign verify --key https://raw.githubusercontent.com/infrafence/infrafence-agent/main/cosign.pub ghcr.io/infrafence/infrafence-agent:latest

Helm chart

The chart is signed with a dedicated GPG key, separate from the Cosign key:

bash
curl -sL https://raw.githubusercontent.com/infrafence/infrafence-agent/main/infrafence-helm-signing-key.asc | gpg --import
helm verify infrafence-agent-<version>.tgz