# EnforceGate vX — Verify, Unpack, Install

Your **docker-host installer** download contains six files:

  - `enforcegate-standalone-pro-2026.57.1-GD-prod.tar.zst` — the signed installer tarball
  - `enforcegate-standalone-pro-2026.57.1-GD-prod.tar.zst.sig` — the cosign signature bundle
  - `exosys-release.pub` — the public key that produced the signature
  - `SHA256SUMS`, `SHA512SUMS` — checksum manifests for quick integrity
  - `VERIFY.md` — this file

If you downloaded a **VM image** (`.ova` / `.qcow2` / `.vmdk` / `.vhdx`) or the
**bare-metal ISO** instead, it ships the analogous files (the image, its `.sig`,
and `SHA256SUMS` / `SHA512SUMS`) and is verified exactly the same way — see
§ 3, "Other download formats", below.

This file is the runbook for verifying your download BEFORE you use it. After
unpacking the installer tarball, see `README.md` inside the
`enforcegate-installer/` directory for the rest of the setup flow.

## 1. Quick integrity check (optional but recommended)

Plain GNU checksum manifests cover every file in this drop — useful
for catching a corrupt download before you reach for cosign:

```sh
sha256sum -c SHA256SUMS
sha512sum -c SHA512SUMS
```

Each line should print `OK`. If any prints `FAILED`, re-download
that file before proceeding. The manifests don't replace the cosign
signature verification in step 2 — they catch transport corruption,
not deliberate tampering.

## 2. Verify the signature

You need `cosign` 2.5.x for signature verification. The base build is
enough — no PIV / PKCS#11 / smart-card support needed on the verify
side (those build tags are only for the signing host). Install one
of the two ways:

**Option A — pre-built static binary (recommended)**

```sh
# pick the matching arch from cosign's releases
curl -fsSL -o cosign \
    https://github.com/sigstore/cosign/releases/download/v2.5.3/cosign-linux-amd64
chmod +x cosign
sudo mv cosign /usr/local/bin/
```

**Option B — build from source via `go install`**

```sh
go install github.com/sigstore/cosign/v2/cmd/cosign@v2.5.3
export PATH="$HOME/go/bin:$PATH"
```

On openSUSE MicroOS the source-build path needs Go first:

```sh
sudo transactional-update pkg install go && sudo reboot
# after reboot:
go install github.com/sigstore/cosign/v2/cmd/cosign@v2.5.3
export PATH="$HOME/go/bin:$PATH"
```

Then verify:

```sh
cosign verify-blob --insecure-ignore-tlog \
    --key exosys-release.pub \
    --bundle enforcegate-standalone-pro-2026.57.1-GD-prod.tar.zst.sig \
    enforcegate-standalone-pro-2026.57.1-GD-prod.tar.zst
```

You should see `Verified OK`. Any other output means the tarball
has been tampered with in transit; do not proceed.

## 3. Other download formats (VM images, ISO)

The two checks above verify **every** EnforceGate download — not only the
installer tarball. Each format ships with its own `SHA256SUMS` / `SHA512SUMS`
manifest and a per-file `<name>.sig` cosign bundle, all signed by this same
`exosys-release.pub`. Run the SAME two commands, substituting the file you
downloaded:

```sh
# 1. integrity — checks every file in the manifest beside your download:
sha256sum -c SHA256SUMS

# 2. authenticity — one cosign call per file (example here: the OVA):
cosign verify-blob --insecure-ignore-tlog \
    --key exosys-release.pub \
    --bundle enforcegate-vX-2026.57.1-GD.ova.sig \
    enforcegate-vX-2026.57.1-GD.ova
```

Swap the filename for the format you have — each must print `Verified OK`:

| Platform | File to verify | After verifying |
|---|---|---|
| VMware / VirtualBox | `enforcegate-vX-2026.57.1-GD.ova` | import the appliance |
| KVM / QEMU / Proxmox | `enforcegate-vX-2026.57.1-GD.qcow2` | attach as the boot disk |
| VMware (plain disk) | `enforcegate-vX-2026.57.1-GD.vmdk` | attach as the boot disk |
| Microsoft Hyper-V | `enforcegate-vX-2026.57.1-GD.vhdx` | attach as the boot disk |
| Bare metal | `enforcegate-vX-appliance.x86_64-2026.57.1-GD.install.iso` | write to USB, then boot |

VM images and the ISO are self-installing — there is **no** `tar -xf` /
`install.sh` step (steps 4–5 below are only for the docker-host installer
tarball). On first boot they run the same setup wizard.

## 4. Unpack (docker-host installer)

```sh
tar -xf enforcegate-standalone-pro-2026.57.1-GD-prod.tar.zst
cd enforcegate-installer
```

## 5. Install (docker-host installer)

```sh
./install.sh
```

The installer walks you through EULA review, license credential
entry, network configuration, and SSL inspection mode, then loads
the signed container images and brings up the stack. See
`enforcegate-installer/README.md` for full step-by-step
documentation including troubleshooting.

## 6. Trust anchor

`exosys-release.pub` is the long-term Exosys release public key.
Its sha256 should match the one published at
<https://docs.exosys.ch/keys/exosys-release.pub.sha256>. Compare:

```sh
sha256sum exosys-release.pub
```

This sha256: `61545e5d72720098246d794d9f8982e6f7d6c155cc0cb952b7df66462c2971a0`

## Support

- Product documentation: <https://docs.exosys.ch/enforcegate-vx>
- Vendor:                <https://exosys.ch>

---

Tarball: `enforcegate-standalone-pro-2026.57.1-GD-prod.tar.zst`
Version: `2026.57.1-GD-prod`
Built:   `2026-09-11 09:13:48 UTC` by `eprom@unknown`