ABM Персона

Verifying the installation bundle

The bundle for installing in your environment is signed with the ABM Персона release key. Verify the signature before moving the archive in, and pass the key fingerprint to the installer.

Release key

Key ID
abm-release-2026-10
Algorithm
ECDSA P-256, SHA-256
Fingerprint (SHA-256 of the public key)
EBD0 4D7B 22EF A105 78C0 8107 60DF 71DC DF06 E773 87F7 8F0C C132 6C45 253E F82D

Download the public key (PEM)

How to verify

  1. 1. Check the key

    Compute the fingerprint of the downloaded key. It must match the fingerprint on this page and in the delivery documents: two independent channels.

    openssl pkey -pubin -in abm-release-2026-10.pem -outform DER | sha256sum

  2. 2. Verify the archive before moving it in

    Only openssl and sha256sum are needed. The answers are “Verified OK” and “OK”. For the first installation this is the check that matters: the installer repeats it, but it ships inside the bundle.

    openssl dgst -sha256 -verify abm-release-2026-10.pem \
  -signature abm-persona-onprem-<version>.tar.sha256.sig \
  abm-persona-onprem-<version>.tar.sha256
sha256sum -c abm-persona-onprem-<version>.tar.sha256

  3. 3. Install with the fingerprint

    Before changing anything on the system, the installer matches the bundle key against the fingerprint, verifies the signature and checks that the bundle holds no extra file. The key is pinned in /opt/abm-persona/trust.

    sudo ./install.sh --address abm.example.ru --admin-email it@example.ru \
  --key-fingerprint "EBD0 4D7B 22EF A105 78C0 8107 60DF 71DC DF06 E773 87F7 8F0C C132 6C45 253E F82D"

  4. 4. Upgrade with the installed copy

    A new bundle is verified by the installed system with its pinned keys, before the backup and before any change. A new release key is accepted only in a bundle signed by the previous one.

    sudo /opt/abm-persona/upgrade.sh /path/abm-persona-onprem-<new-version>

If the fingerprint does not match or a check answers otherwise, do not install the bundle and let us know. Contacts

GOST signature

A qualified electronic signature (GOST R 34.10-2012) for the bundles is being obtained. Until then the bundles are signed with the ECDSA key described above; once the certificate is issued, its fingerprints and verification commands will appear here.

Revoked keys

Bundles signed with these keys must not be installed even if the signature verifies. An installation that has received any update released after the revocation date refuses such bundles on its own: the revocation list travels inside the bundle under the current key's signature and is kept on the server permanently.

KeyRevoked onSHA-256 fingerprintReason
abm-release-2026-092026-10-111B3A FF2B 0F29 04EC EAD0 5D07 B27D D2E5 5FB0 30CB 6BE5 2FC8 6373 1438 5584 6298ключ создавался и хранился вне РФ; выпуск переведён на машину ключей в РФ

An installation that has only the revoked key pinned receives the current key by fingerprint from this page, once, during an upgrade:

cd abm-persona-onprem-<version> && sudo ./upgrade.sh --key-fingerprint "EBD0 4D7B 22EF A105 78C0 8107 60DF 71DC DF06 E773 87F7 8F0C C132 6C45 253E F82D"
Verifying the installation bundle. ABM Персона