Skip to content
Auditix Docs

Signatures

Every package file is signed by its publisher, with a key the Auditix marketplace certifies (see Publisher key). Before installing anything, from the catalogue or from a file, Auditix checks that:

  1. the certificate of the publisher’s key is signed by the Auditix marketplace;
  2. the file is signed by that key, so it was not altered after its publisher signed it;
  3. the package belongs to the publisher named by the certificate.

The preview of an offline import shows the result, with the publisher and its handle:

Signed by NetVendor Labs (netvendor-labs), certified by the Auditix marketplace

Files made by older versions of the marketplace are signed by the marketplace itself; they are still accepted and show Signed by the Auditix marketplace.

Certified packages

Section titled “Certified packages”

The Certified badge next to a publisher marks packages published by Auditix or certified by the vendor of the equipment. Other packages show Community: they are signed and verified just the same, but published by someone else.

When a check fails

Section titled “When a check fails”

The whole file is refused and nothing is installed. The messages:

Message Meaning
This is not a package file. The file is not a package (truncated, or another kind of file). Download it again.
The certificate of this package file is invalid. The certificate it carries is damaged.
The certificate of this package file is not signed by the Auditix marketplace. The key was not certified by the marketplace this instance trusts.
This package file is not signed by the key of its publisher: it may have been altered. The content changed after signing. Do not install it; download it again from the marketplace.
This package is not signed by its publisher. The package names a publisher other than the owner of the key.
This package file is not signed by the Auditix marketplace. An older file whose marketplace signature does not check.
The package holds an invalid item: … An item of the package breaks the rules of Auditix (a name too long, a model referring to a manufacturer the package does not hold…). Contact the publisher.