Recherche avancée
Autres articles (68)
-
MediaSPIP version 0.1 Beta
16 avril 2011, parMediaSPIP 0.1 beta est la première version de MediaSPIP décrétée comme "utilisable".
Le fichier zip ici présent contient uniquement les sources de MediaSPIP en version standalone.
Pour avoir une installation fonctionnelle, il est nécessaire d’installer manuellement l’ensemble des dépendances logicielles sur le serveur.
Si vous souhaitez utiliser cette archive pour une installation en mode ferme, il vous faudra également procéder à d’autres modifications (...) -
MediaSPIP 0.1 Beta version
25 avril 2011, parMediaSPIP 0.1 beta is the first version of MediaSPIP proclaimed as "usable".
The zip file provided here only contains the sources of MediaSPIP in its standalone version.
To get a working installation, you must manually install all-software dependencies on the server.
If you want to use this archive for an installation in "farm mode", you will also need to proceed to other manual (...) -
Amélioration de la version de base
13 septembre 2013Jolie sélection multiple
Le plugin Chosen permet d’améliorer l’ergonomie des champs de sélection multiple. Voir les deux images suivantes pour comparer.
Il suffit pour cela d’activer le plugin Chosen (Configuration générale du site > Gestion des plugins), puis de configurer le plugin (Les squelettes > Chosen) en activant l’utilisation de Chosen dans le site public et en spécifiant les éléments de formulaires à améliorer, par exemple select[multiple] pour les listes à sélection multiple (...)
Sur d’autres sites (12538)
-
Error transcoding with FFmpeg : Error : Output format hls is not available
6 mai 2024, par asif mohmdI am using FFmpeg library to transcode a video file into multiple resolutions and create an HLS (HTTP Live Streaming) master playlist.


It takes a video file as input but its does give me the output with HLS playlist.I got a error called "Output format hls is not available". Only the Output directory is creating


I am using FFMpeg 7.0 full build version and also tried older versions and ffmpeg essentials and also tried chocolatey.


if i remove the implementation of HLS from this code.it will create 4 different resolution videos in my output.


Note:I just tried this same code on my friend MAC Book by only changing the setffmpegPath : "ffmpeg.setFfmpegPath("C :\ffmpeg\bin\ffmpeg.exe") ;" to his ffmpeg directory.
Its working perfectly in his mac book


import "dotenv/config";
import * as fs from "fs";
import * as path from "path";
import ffmpeg from "fluent-ffmpeg";
import crypto from "crypto";

ffmpeg.setFfmpegPath("C:\\ffmpeg\\bin\\ffmpeg.exe");

export const FFmpegTranscoder = async (file: any): Promise<any> => {
 try {
 console.log("Starting script");
 console.time("req_time");

 const randomName = (bytes = 32) =>
 crypto.randomBytes(bytes).toString("hex");
 const fileName = randomName();
 const directoryPath = path.join(__dirname, "..", "..", "input");
 const filePath = path.join(directoryPath, `${fileName}.mp4`);

 if (!fs.existsSync(directoryPath)) {
 fs.mkdirSync(directoryPath, { recursive: true });
 }

 const paths = await new Promise<any>((resolve, reject) => {
 fs.writeFile(filePath, file, async (err) => {
 if (err) {
 console.error("Error saving file:", err);
 throw err;
 }
 console.log("File saved successfully:", filePath);

 try {
 const outputDirectoryPath = await transcodeWithFFmpeg(
 fileName,
 filePath
 );
 resolve({ directoryPath, filePath, fileName, outputDirectoryPath });
 } catch (error) {
 console.error("Error transcoding with FFmpeg:", error);
 }
 });
 });
 return paths;
 } catch (e: any) {
 console.log(e);
 }
};

const transcodeWithFFmpeg = async (fileName: string, filePath: string) => {
 const directoryPath = path.join(
 __dirname,
 "..",
 "..",
 `output/hls/${fileName}`
 );

 if (!fs.existsSync(directoryPath)) {
 fs.mkdirSync(directoryPath, { recursive: true });
 }

 const resolutions = [
 {
 resolution: "256x144",
 videoBitrate: "200k",
 audioBitrate: "64k",
 },
 {
 resolution: "640x360",
 videoBitrate: "800k",
 audioBitrate: "128k",
 },
 {
 resolution: "1280x720",
 videoBitrate: "2500k",
 audioBitrate: "192k",
 },
 {
 resolution: "1920x1080",
 videoBitrate: "5000k",
 audioBitrate: "256k",
 },
 ];

 const variantPlaylists: { resolution: string; outputFileName: string }[] = [];

 for (const { resolution, videoBitrate, audioBitrate } of resolutions) {
 console.log(`HLS conversion starting for ${resolution}`);
 const outputFileName = `${fileName}_${resolution}.m3u8`;
 const segmentFileName = `${fileName}_${resolution}_%03d.ts`;

 await new Promise<void>((resolve, reject) => {
 ffmpeg(filePath)
 .outputOptions([
 `-c:v h264`,
 `-b:v ${videoBitrate}`,
 `-c:a aac`,
 `-b:a ${audioBitrate}`,
 `-vf scale=${resolution}`,
 `-f hls`,
 `-hls_time 10`,
 `-hls_list_size 0`,
 `-hls_segment_filename ${directoryPath}/${segmentFileName}`,
 ])
 .output(`${directoryPath}/${outputFileName}`)
 .on("end", () => resolve())
 .on("error", (err) => reject(err))
 .run();
 });
 const variantPlaylist = {
 resolution,
 outputFileName,
 };
 variantPlaylists.push(variantPlaylist);
 console.log(`HLS conversion done for ${resolution}`);
 }
 console.log(`HLS master m3u8 playlist generating`);

 let masterPlaylist = variantPlaylists
 .map((variantPlaylist) => {
 const { resolution, outputFileName } = variantPlaylist;
 const bandwidth =
 resolution === "256x144"
 ? 264000
 : resolution === "640x360"
 ? 1024000
 : resolution === "1280x720"
 ? 3072000
 : 5500000;
 ``;
 return `#EXT-X-STREAM-INF:BANDWIDTH=${bandwidth},RESOLUTION=${resolution}\n${outputFileName}`;
 })
 .join("\n");
 masterPlaylist = `#EXTM3U\n` + masterPlaylist;

 const masterPlaylistFileName = `${fileName}_master.m3u8`;

 const masterPlaylistPath = `${directoryPath}/${masterPlaylistFileName}`;
 fs.writeFileSync(masterPlaylistPath, masterPlaylist);
 console.log(`HLS master m3u8 playlist generated`);
 return directoryPath;
};
</void></any></any>

My console.log is :


Starting script
 HLS conversion starting for 256x144
 Error transcoding with FFmpeg: Error: Output format hls is not available
 at C:\Users\asifa\Desktop\Genius Grid\Transcode-service\node_modules\fluent-ffmpeg\lib\capabilities.js:589:21
 at nextTask (C:\Users\asifa\Desktop\Genius Grid\Transcode-service\node_modules\async\dist\async.js:5791:13)
 at next (C:\Users\asifa\Desktop\Genius Grid\Transcode-service\node_modules\async\dist\async.js:5799:13)
 at C:\Users\asifa\Desktop\Genius Grid\Transcode-service\node_modules\async\dist\async.js:329:20
 at C:\Users\asifa\Desktop\Genius Grid\Transcode-service\node_modules\fluent-ffmpeg\lib\capabilities.js:549:7
 at handleExit (C:\Users\asifa\Desktop\Genius Grid\Transcode-service\node_modules\fluent-ffmpeg\lib\processor.js:170:11)
 at ChildProcess.<anonymous> (C:\Users\asifa\Desktop\Genius Grid\Transcode-service\node_modules\fluent-ffmpeg\lib\processor.js:184:11)
 at ChildProcess.emit (node:events:518:28)
 at ChildProcess.emit (node:domain:488:12)
 at Process.ChildProcess._handle.onexit (node:internal/child_process:294:12) 
</anonymous>

I am using Windows 11 and FFMpeg version 7.0. I repeatedly checked, using CMD commands, that my FFMpeg was installed correctly and confirmed the environment variables path, experimented with various FFMpeg versions, and tried with FFMpeg full build Chocolatey package.


In Command Line its working perfectly :


PS C:\Users\asifa\Desktop\test fmmpeg> ffmpeg -hide_banner -y -i .\SampleVideo_1280x720_30mb.mp4 -vf scale=w=640:h=360:force_original_aspect_ratio=decrease -c:a aac -b:v 800k -c:v h264 -b:a 128k -f hls -hls_time 14 -hls_list_size 0 -hls_segment_filename beach/480p_%03d.ts beach/480p.m3u8
Input #0, mov,mp4,m4a,3gp,3g2,mj2, from '.\SampleVideo_1280x720_30mb.mp4':
 Metadata:
 major_brand : isom
 minor_version : 512
 compatible_brands: isomiso2avc1mp41
 creation_time : 1970-01-01T00:00:00.000000Z
 encoder : Lavf53.24.2
 Duration: 00:02:50.86, start: 0.000000, bitrate: 1474 kb/s
 Stream #0:0[0x1](und): Video: h264 (Main) (avc1 / 0x31637661), yuv420p(progressive), 1280x720 [SAR 1:1 DAR 16:9], 1086 kb/s, 25 fps, 25 tbr, 12800 tbn (default)
 Metadata:
 creation_time : 1970-01-01T00:00:00.000000Z
 handler_name : VideoHandler
 vendor_id : [0][0][0][0]
 Stream #0:1[0x2](und): Audio: aac (LC) (mp4a / 0x6134706D), 48000 Hz, 5.1, fltp, 383 kb/s (default)
 Metadata:
 creation_time : 1970-01-01T00:00:00.000000Z
 handler_name : SoundHandler
 vendor_id : [0][0][0][0]
Stream mapping:
 Stream #0:0 -> #0:0 (h264 (native) -> h264 (libx264))
 Stream #0:1 -> #0:1 (aac (native) -> aac (native))
Press [q] to stop, [?] for help
[libx264 @ 000001ef1288ec00] using SAR=1/1
[libx264 @ 000001ef1288ec00] using cpu capabilities: MMX2 SSE2Fast SSSE3 SSE4.2 AVX FMA3 BMI2 AVX2
[libx264 @ 000001ef1288ec00] profile High, level 3.0, 4:2:0, 8-bit
[libx264 @ 000001ef1288ec00] 264 - core 164 r3190 7ed753b - H.264/MPEG-4 AVC codec - Copyleft 2003-2024 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=11 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=abr mbtree=1 bitrate=800 ratetol=1.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00
Output #0, hls, to 'beach/480p.m3u8':
 Metadata:
 major_brand : isom
 minor_version : 512
 compatible_brands: isomiso2avc1mp41
 encoder : Lavf61.1.100
 Stream #0:0(und): Video: h264, yuv420p(progressive), 640x360 [SAR 1:1 DAR 16:9], q=2-31, 800 kb/s, 25 fps, 90k tbn (default)
 Metadata:
 creation_time : 1970-01-01T00:00:00.000000Z
 handler_name : VideoHandler
 vendor_id : [0][0][0][0]
 encoder : Lavc61.3.100 libx264
 Side data:
 cpb: bitrate max/min/avg: 0/0/800000 buffer size: 0 vbv_delay: N/A
 Stream #0:1(und): Audio: aac (LC), 48000 Hz, 5.1, fltp, 128 kb/s (default)
 Metadata:
 creation_time : 1970-01-01T00:00:00.000000Z
 handler_name : SoundHandler
 vendor_id : [0][0][0][0]
 encoder : Lavc61.3.100 aac
[hls @ 000001ef12482040] Opening 'beach/480p_000.ts' for writing speed=15.5x
[hls @ 000001ef12482040] Opening 'beach/480p.m3u8.tmp' for writing
[hls @ 000001ef12482040] Opening 'beach/480p_001.ts' for writing speed=17.9x
[hls @ 000001ef12482040] Opening 'beach/480p.m3u8.tmp' for writing
[hls @ 000001ef12482040] Opening 'beach/480p_002.ts' for writing speed=17.3x
[hls @ 000001ef12482040] Opening 'beach/480p.m3u8.tmp' for writing
[hls @ 000001ef12482040] Opening 'beach/480p_003.ts' for writing speed=19.4x
[hls @ 000001ef12482040] Opening 'beach/480p.m3u8.tmp' for writing
[hls @ 000001ef12482040] Opening 'beach/480p_004.ts' for writing speed=19.3x
[hls @ 000001ef12482040] Opening 'beach/480p.m3u8.tmp' for writing
[hls @ 000001ef12482040] Opening 'beach/480p_005.ts' for writing speed=19.2x
[hls @ 000001ef12482040] Opening 'beach/480p.m3u8.tmp' for writing
[hls @ 000001ef12482040] Opening 'beach/480p_006.ts' for writing
[hls @ 000001ef12482040] Opening 'beach/480p.m3u8.tmp' for writing
[hls @ 000001ef12482040] Opening 'beach/480p_007.ts' for writing speed=19.4x
[hls @ 000001ef12482040] Opening 'beach/480p.m3u8.tmp' for writing
[hls @ 000001ef12482040] Opening 'beach/480p_008.ts' for writing speed=19.5x
[hls @ 000001ef12482040] Opening 'beach/480p.m3u8.tmp' for writing
[hls @ 000001ef12482040] Opening 'beach/480p_009.ts' for writing speed=19.5x
[hls @ 000001ef12482040] Opening 'beach/480p.m3u8.tmp' for writing
[hls @ 000001ef12482040] Opening 'beach/480p_010.ts' for writing speed=19.4x
[hls @ 000001ef12482040] Opening 'beach/480p.m3u8.tmp' for writing
[hls @ 000001ef12482040] Opening 'beach/480p_011.ts' for writing/A =19.4x
[hls @ 000001ef12482040] Opening 'beach/480p.m3u8.tmp' for writing
[out#0/hls @ 000001ef11d4e880] video:17094KiB audio:2680KiB subtitle:0KiB other streams:0KiB global headers:0KiB muxing overhead: unknown
frame= 4271 fps=485 q=-1.0 Lsize=N/A time=00:02:50.76 bitrate=N/A speed=19.4x
[libx264 @ 000001ef1288ec00] frame I:45 Avg QP:10.29 size: 60418
[libx264 @ 000001ef1288ec00] frame P:1914 Avg QP:14.53 size: 5582
[libx264 @ 000001ef1288ec00] frame B:2312 Avg QP:20.63 size: 1774
[libx264 @ 000001ef1288ec00] consecutive B-frames: 22.9% 11.9% 8.6% 56.6%
[libx264 @ 000001ef1288ec00] mb I I16..4: 15.6% 32.1% 52.2%
[libx264 @ 000001ef1288ec00] mb P I16..4: 0.3% 3.4% 1.2% P16..4: 20.3% 10.0% 13.1% 0.0% 0.0% skip:51.8%
[libx264 @ 000001ef1288ec00] mb B I16..4: 0.1% 0.9% 0.4% B16..8: 17.2% 5.6% 2.8% direct: 2.0% skip:71.0% L0:41.5% L1:44.1% BI:14.4%
[libx264 @ 000001ef1288ec00] final ratefactor: 16.13
[libx264 @ 000001ef1288ec00] 8x8 transform intra:58.4% inter:51.7%
[libx264 @ 000001ef1288ec00] coded y,uvDC,uvAC intra: 86.7% 94.3% 78.8% inter: 12.6% 15.0% 4.5%
[libx264 @ 000001ef1288ec00] i16 v,h,dc,p: 17% 42% 14% 28%
[libx264 @ 000001ef1288ec00] i8 v,h,dc,ddl,ddr,vr,hd,vl,hu: 23% 19% 11% 6% 7% 8% 8% 9% 9%
[libx264 @ 000001ef1288ec00] i4 v,h,dc,ddl,ddr,vr,hd,vl,hu: 23% 18% 12% 6% 9% 9% 8% 8% 7%
[libx264 @ 000001ef1288ec00] i8c dc,h,v,p: 44% 24% 20% 12%
[libx264 @ 000001ef1288ec00] Weighted P-Frames: Y:0.0% UV:0.0%
[libx264 @ 000001ef1288ec00] ref P L0: 78.3% 9.7% 8.8% 3.2%
[libx264 @ 000001ef1288ec00] ref B L0: 92.5% 6.0% 1.5%
[libx264 @ 000001ef1288ec00] ref B L1: 97.1% 2.9%
[libx264 @ 000001ef1288ec00] kb/s:819.63
[aac @ 000001ef128f7c80] Qavg: 452.137


When I use the
.on('start', (cmdline) => console.log(cmdline))}code with the-f hlscommand, the error "Output format hls is not available" appears, as previously mentioned. But my Console.log looks like this if I run my code without using-f hlscommand :

Without -f hls command


await new Promise<void>((resolve, reject) => {
 ffmpeg(filePath)
 .outputOptions([
 `-c:v h264`,
 `-b:v ${videoBitrate}`,
 `-c:a aac`,
 `-b:a ${audioBitrate}`,
 `-vf scale=${resolution}`,
 
 `-hls_time 10`,
 `-hls_list_size 0`,
 `-hls_segment_filename ${directoryPath}/${segmentFileName}`,
 ])
 .output(`${directoryPath}/${outputFileName}`)
 .on('start', (cmdline) => console.log(cmdline)) 
 .on("end", () => resolve())
 .on("error", (err) => reject(err))
 .run();
});
</void>

Console.log is :


`Starting script
File saved successfully: C:\Users\asifa\Desktop\Genius Grid\Transcode-service\input\c9fcf43726e617a295b203d5acb7b81658b5f05f80eafc74cee21b053422fef1.mp4
HLS conversion starting for 256x144
ffmpeg -i C:\Users\asifa\Desktop\Genius Grid\Transcode-service\input\c9fcf43726e617a295b203d5acb7b81658b5f05f80eafc74cee21b053422fef1.mp4 -y -c:v h264 -b:v 200k -c:a aac -b:a 64k -vf scale=256x144 -hls_time 10 -hls_list_size 0 -hls_segment_filename C:\Users\asifa\Desktop\Genius Grid\Transcode-service\output\hls\c9fcf43726e617a295b203d5acb7b81658b5f05f80eafc74cee21b053422fef1/c9fcf43726e617a295b203d5acb7b81658b5f05f80eafc74cee21b053422fef1_256x144_%03d.ts C:\Users\asifa\Desktop\Genius Grid\Transcode-service\output\hls\c9fcf43726e617a295b203d5acb7b81658b5f05f80eafc74cee21b053422fef1/c9fcf43726e617a295b203d5acb7b81658b5f05f80eafc74cee21b053422fef1_256x144.m3u8
Error transcoding with FFmpeg: Error: ffmpeg exited with code 2880417800: Unrecognized option 'hls_segment_filename C:\Users\asifa\Desktop\Genius Grid\Transcode-service\output\hls\c9fcf43726e617a295b203d5acb7b81658b5f05f80eafc74cee21b053422fef1/c9fcf43726e617a295b203d5acb7b81658b5f05f80eafc74cee21b053422fef1_256x144_%03d.ts'.
Error splitting the argument list: Option not found`


-
How to verify signatures for Piwik release packages
19 novembre 2014, par Piwik Core Team — SecurityWe are proud to announce that Piwik project now cryptographically signs the Piwik releases using PGP following requests from several community members. In this post we will explain how you can verify the signatures of the Piwik release you downloaded, with instructions for Windows, Mac OS X and Linux.
What is a signature and why should I check it ?
How do you know that the Piwik platform you have is really the one we made ? Some software sites list sha1 hashes alongside the software on their website, so users can verify that they downloaded the file without any errors. These “checksums” help you answer the question “Did I download this file correctly from whoever sent it to me ?” They do a good job at making sure you didn’t have any random errors in your download, but they don’t help you figure out whether you were downloading it from a compromised server. The better question to answer is : “Is this file that I just downloaded the file that Piwik intended me to get ?”. Over the years several Piwik users have requested that we start signing our releases.
Where do I get the signatures and the keys that made them ?
Each file on our release server builds.piwik.org is accompanied by a file with the same name as the package and the extension
.asc. These .asc files are GPG signatures. They allow you to verify the file you’ve downloaded is exactly the one that we intended you to get. For example,piwik-2.9.0.zipis accompanied bypiwik-2.9.0.zip.asc<code>.Currently Matthieu Aubry is the release manager and signs the Piwik releases. His signature can be found here : builds.piwik.org/signature.asc
How to verify signatures on Windows
You need to have GnuPG installed before you can verify signatures. Download it from http://gpg4win.org/download.html.
Once it’s installed, use GnuPG to import the key that signed your package. Since GnuPG for Windows is a command-line tool, you will need to use cmd.exe. Unless you edit your PATH environment variable, you will need to tell Windows the full path to the GnuPG program. If you installed GnuPG with the default values, the path should be something like this : C :\Program Files\Gnu\GnuPg\gpg.exe.
Import Piwik Release manager Matthieu’s key (0x416F061063FEE659) by starting cmd.exe and typing :
"C :\Program Files\Gnu\GnuPg\gpg.exe" —keyserver keys.gnupg.net —recv-keys 814E346FA01A20DBB04B6807B5DBD5925590A237
After importing the key, you can verify that the fingerprint is correct :
"C :\Program Files\Gnu\GnuPg\gpg.exe" —fingerprint 814E346FA01A20DBB04B6807B5DBD5925590A237
You should see :
pub 4096R/5590A237 2013-07-24 Key fingerprint = 814E 346F A01A 20DB B04B 6807 B5DB D592 5590 A237 uid Matthieu Aubry <matt@piwik.org> uid Matthieu Aubry <matthieu.aubry@gmail.com> uid Matthieu Aubry <matt@piwik.pro> sub 4096R/43F0D330 2013-07-24To verify the signature of the package you downloaded, you will need to download the ".asc" file as well. Assuming you downloaded the package and its signature to your Desktop, run :
"C :\Program Files\Gnu\GnuPg\gpg.exe" —verify C :\Users\Alice\Desktop\piwik-2.9.0.zip.asc C :\Users\Alice\Desktop\piwik-2.9.0.zip
The output should say "Good signature" :
gpg : Signature made Thu 13 Nov 2014 17:42:18 NZDT using RSA key ID 5590A237 gpg : Good signature from "Matthieu Aubry <matt@piwik.org>" gpg : aka "Matthieu Aubry <matthieu.aubry@gmail.com>" gpg : aka "Matthieu Aubry <matt@piwik.pro>"
Notice that there may be a warning in case you haven’t assigned a trust index to this person. This means that GnuPG verified that the key made that signature, but it’s up to you to decide if that key really belongs to the developer. The best method is to meet the developer in person and exchange key fingerprints.
Mac OS X and Linux
On Linux GnuPG is usually installed by default. On Mac OS X, you need to have GnuPG installed before you can verify signatures. You can install it from http://www.gpgtools.org/.
Once it’s installed, use GnuPG to import the key that signed your package. Matthieu Aubry signs the Piwik releases. Import his key (814E346FA01A20DBB04B6807B5DBD5925590A237) by starting the terminal (under "Applications") and typing :
gpg —keyserver keys.gnupg.net —recv-keys 814E346FA01A20DBB04B6807B5DBD5925590A237
After importing the key, you can verify that the fingerprint is correct :
gpg —fingerprint 814E346FA01A20DBB04B6807B5DBD5925590A237
You should see :
pub 4096R/5590A237 2013-07-24 Key fingerprint = 814E 346F A01A 20DB B04B 6807 B5DB D592 5590 A237 uid Matthieu Aubry <matt@piwik.org> uid Matthieu Aubry <matthieu.aubry@gmail.com> uid Matthieu Aubry <matt@piwik.pro> sub 4096R/43F0D330 2013-07-24To verify the signature of the package you downloaded, you will need to download the ".asc" file as well. Assuming you downloaded the package and its signature to your Desktop, run :
gpg —verify /Users/Alice/piwik-2.9.0.zip.asc*,
The output should say "Good signature" :
gpg : Signature made Thu 13 Nov 2014 17:42:18 NZDT using RSA key ID 5590A237 gpg : Good signature from "Matthieu Aubry <matt@piwik.org>" gpg : aka "Matthieu Aubry <matthieu.aubry@gmail.com>" gpg : aka "Matthieu Aubry <matt@piwik.pro>"
Notice that there may be a warning in case you haven’t assigned a trust index to this person. This means that GnuPG verified that the key made that signature, but it’s up to you to decide if that key really belongs to the developer. The best method is to meet the developer in person and exchange key fingerprints.
That’s it ! In this article you have learnt how you can verify that the Piwik package you have downloaded on your computer was the same as the one Piwik team has officially created. We hope this helps you use Piwik with more security.
Source : this article was copied and adapted from the great Tor Browser project website page How to verify signatures for Tor packages
-
How to verify signatures for Piwik release packages
19 novembre 2014, par Piwik Core Team — SecurityWe are proud to announce that Piwik project now cryptographically signs the Piwik releases using PGP following requests from several community members. In this post we will explain how you can verify the signatures of the Piwik release you downloaded, with instructions for Windows, Mac OS X and Linux.
What is a signature and why should I check it ?
How do you know that the Piwik platform you have is really the one we made ? Some software sites list sha1 hashes alongside the software on their website, so users can verify that they downloaded the file without any errors. These “checksums” help you answer the question “Did I download this file correctly from whoever sent it to me ?” They do a good job at making sure you didn’t have any random errors in your download, but they don’t help you figure out whether you were downloading it from a compromised server. The better question to answer is : “Is this file that I just downloaded the file that Piwik intended me to get ?”. Over the years several Piwik users have requested that we start signing our releases.
Where do I get the signatures and the keys that made them ?
Each file on our release server builds.piwik.org is accompanied by a file with the same name as the package and the extension
.asc. These .asc files are GPG signatures. They allow you to verify the file you’ve downloaded is exactly the one that we intended you to get. For example,piwik-2.9.0.zipis accompanied bypiwik-2.9.0.zip.asc<code>.Currently Matthieu Aubry is the release manager and signs the Piwik releases. His signature can be found here : builds.piwik.org/signature.asc
How to verify signatures on Windows
You need to have GnuPG installed before you can verify signatures. Download it from http://gpg4win.org/download.html.
Once it’s installed, use GnuPG to import the key that signed your package. Since GnuPG for Windows is a command-line tool, you will need to use cmd.exe. Unless you edit your PATH environment variable, you will need to tell Windows the full path to the GnuPG program. If you installed GnuPG with the default values, the path should be something like this : C :\Program Files\Gnu\GnuPg\gpg.exe.
Import Piwik Release manager Matthieu’s key (0x416F061063FEE659) by starting cmd.exe and typing :
"C :\Program Files\Gnu\GnuPg\gpg.exe" —keyserver keys.gnupg.net —recv-keys 814E346FA01A20DBB04B6807B5DBD5925590A237
After importing the key, you can verify that the fingerprint is correct :
"C :\Program Files\Gnu\GnuPg\gpg.exe" —fingerprint 814E346FA01A20DBB04B6807B5DBD5925590A237
You should see :
pub 4096R/5590A237 2013-07-24 Key fingerprint = 814E 346F A01A 20DB B04B 6807 B5DB D592 5590 A237 uid Matthieu Aubry <matt@piwik.org> uid Matthieu Aubry <matthieu.aubry@gmail.com> uid Matthieu Aubry <matt@piwik.pro> sub 4096R/43F0D330 2013-07-24To verify the signature of the package you downloaded, you will need to download the ".asc" file as well. Assuming you downloaded the package and its signature to your Desktop, run :
"C :\Program Files\Gnu\GnuPg\gpg.exe" —verify C :\Users\Alice\Desktop\piwik-2.9.0.zip.asc C :\Users\Alice\Desktop\piwik-2.9.0.zip
The output should say "Good signature" :
gpg : Signature made Thu 13 Nov 2014 17:42:18 NZDT using RSA key ID 5590A237 gpg : Good signature from "Matthieu Aubry <matt@piwik.org>" gpg : aka "Matthieu Aubry <matthieu.aubry@gmail.com>" gpg : aka "Matthieu Aubry <matt@piwik.pro>"
Notice that there may be a warning in case you haven’t assigned a trust index to this person. This means that GnuPG verified that the key made that signature, but it’s up to you to decide if that key really belongs to the developer. The best method is to meet the developer in person and exchange key fingerprints.
Mac OS X and Linux
On Linux GnuPG is usually installed by default. On Mac OS X, you need to have GnuPG installed before you can verify signatures. You can install it from http://www.gpgtools.org/.
Once it’s installed, use GnuPG to import the key that signed your package. Matthieu Aubry signs the Piwik releases. Import his key (814E346FA01A20DBB04B6807B5DBD5925590A237) by starting the terminal (under "Applications") and typing :
gpg —keyserver keys.gnupg.net —recv-keys 814E346FA01A20DBB04B6807B5DBD5925590A237
After importing the key, you can verify that the fingerprint is correct :
gpg —fingerprint 814E346FA01A20DBB04B6807B5DBD5925590A237
You should see :
pub 4096R/5590A237 2013-07-24 Key fingerprint = 814E 346F A01A 20DB B04B 6807 B5DB D592 5590 A237 uid Matthieu Aubry <matt@piwik.org> uid Matthieu Aubry <matthieu.aubry@gmail.com> uid Matthieu Aubry <matt@piwik.pro> sub 4096R/43F0D330 2013-07-24To verify the signature of the package you downloaded, you will need to download the ".asc" file as well. Assuming you downloaded the package and its signature to your Desktop, run :
gpg —verify /Users/Alice/piwik-2.9.0.zip.asc*,
The output should say "Good signature" :
gpg : Signature made Thu 13 Nov 2014 17:42:18 NZDT using RSA key ID 5590A237 gpg : Good signature from "Matthieu Aubry <matt@piwik.org>" gpg : aka "Matthieu Aubry <matthieu.aubry@gmail.com>" gpg : aka "Matthieu Aubry <matt@piwik.pro>"
Notice that there may be a warning in case you haven’t assigned a trust index to this person. This means that GnuPG verified that the key made that signature, but it’s up to you to decide if that key really belongs to the developer. The best method is to meet the developer in person and exchange key fingerprints.
That’s it ! In this article you have learnt how you can verify that the Piwik package you have downloaded on your computer was the same as the one Piwik team has officially created. We hope this helps you use Piwik with more security.
Source : this article was copied and adapted from the great Tor Browser project website page How to verify signatures for Tor packages
Syndiquer tout le site
