When a new VMware Cloud Foundation (VCF) binary is published for download, its filename, size, and checksum are generated and updated in the VCF manifest files, including productVersionCatalog.json (PVC) and its corresponding signature file, productVersionCatalog.sig.
Whether you use the VCF Download Tool (VCFDT) to download the binaries for a local VCF Offline Depot or the VCF Installer to connect directly to Broadcom's download portal, the manifest file is automatically used to verify that the binaries match their expected checksums, preventing corrupted downloads or, worse, compromised software from being deployed.
For those using the VCFDT, below is a typical folder structure (/PROD/COMP) that is automatically created to store all VCF downloads:
Using /PROD/metadata/productVersionCatalog/v1/productVersionCatalog.json, you can search for a particular filename and locate its checksum which is generated using a SHA256 hash.
To manually verify the checksum, we can use the sha256sum utility that is available for both macOS/Linux system or Get-FileHash PowerShell cmdlet for Windows and provide the path to the file. Once the hash is computed, you can compare that to value shown in the PVC JSON file.
You can also find the SHA256 hash for VCF downloads within the Broadcom Support Portal (BSP) by searching under the "VMware Cloud Foundation" product in case you do not have a copy of the PVC, which is automatically downloaded when using the VCFDT.
If you would like to verify the PVC signature file against the PVC file itself, you can run the following:
# Extract the public key
openssl x509 -in productVersionCatalog.sig -pubkey -noout > pubkey.pem
# Convert raw hex to raw binary
awk -F'= ' '/^SHA256/{print $2}' productVersionCatalog.sig | xxd -r -p > signature.bin
# Verify
openssl dgst -sha256 -verify pubkey.pem -signature signature.bin productVersionCatalog.json
No output from the final verify command means signature matches.
Thanks for the comment!