Confirming Integrity and Authenticity of Repository Downloads
Each download from this Repository provides a GPG signature file to confirm the download's integrity and Lenovo's Authenticity. Procedure

1. Obtain Open Source GnuPG tool. This tool is included on almost all Linux installations.

1. The free Microsoft Windows version of the tool is available here: https://gpg4win.org/download.html
2. Install the tool on Microsoft Windows workstation or server used to confirm file.

2. Download and import the Lenovo Data Center Group Public key into the GPG checking workstation or server. Each download within a single repository bundle uses the same Public Key. Lenovo changes the Public Key on a yearly basis.

1. The URL to download Public Side required to confirm the bundle's downloads is provided here.

   Authenticity Signature Public Key Download Securely Download Public Key here: http://iobbdefects.lenovo.com/yum-key/RPM-GPG-KEY-LenovoYUM4096b2018 (suggest using web browser "Save Link As..." feature to Download key) Key fingerprint: `pub 4096R/05AED1D0 2017-11-29 Lenovo Data Center Group Software Repository 2018 Key <repos@lenovo.com>
   Key fingerprint = BC55 5030 122E 1766 3C0C DABF 07A2 C255 05AE D1D0`

2. Import the Public Key into your workstation or server's key repository.
   `> gpg.exe --import public_key.txt`
3. Confirm Public Key fingerprint
   `> gpg.exe --list-keys --fingerprint`
   The 40-digit hexadecimal number provided should exactly match fingerprint provided on Public Key download page noted above.
4. Mark the key as verified
   `> gpg.exe --edit-key fingerprint of key
   gpg> trust
   Your decision? 5
   Do you really want to set this key to ultimate trust? (y/N) y
   gpg> quit
   >gpg.exe --list-keys --fingerprint` Key uid should now have [ultimate] prefix

3. Verification of download

1. Download bundle file
2. Download bundle's Lenovo Authenticity Signature file
3. Verify download
   `>gpg.exe --verify bundle_signature_file bundle_file`
   The gpg tool replying with Good Signature indicates that tested file downloaded without error is authentictly provided by Lenovo.

Return to Instructions Quick Links