Recherche avancée

Sur d’autres sites (4430)

• How to verify signatures for Piwik release packages

  19 novembre 2014, par Piwik Core Team — Security

  We are proud to announce that Piwik project now cryptographically signs the Piwik releases using PGP following requests from several community members. In this post we will explain how you can verify the signatures of the Piwik release you downloaded, with instructions for Windows, Mac OS X and Linux.

  What is a signature and why should I check it ?

  ---

  How do you know that the Piwik platform you have is really the one we made ? Some software sites list sha1 hashes alongside the software on their website, so users can verify that they downloaded the file without any errors. These “checksums” help you answer the question “Did I download this file correctly from whoever sent it to me ?” They do a good job at making sure you didn’t have any random errors in your download, but they don’t help you figure out whether you were downloading it from a compromised server. The better question to answer is : “Is this file that I just downloaded the file that Piwik intended me to get ?”. Over the years several Piwik users have requested that we start signing our releases.

  Where do I get the signatures and the keys that made them ?

  ---

  Each file on our release server builds.piwik.org is accompanied by a file with the same name as the package and the extension .asc. These .asc files are GPG signatures. They allow you to verify the file you’ve downloaded is exactly the one that we intended you to get. For example, piwik-2.9.0.zip is accompanied by piwik-2.9.0.zip.asc<code>.

  Currently Matthieu Aubry is the release manager and signs the Piwik releases. His signature can be found here : builds.piwik.org/signature.asc

  How to verify signatures on Windows

  ---

  You need to have GnuPG installed before you can verify signatures. Download it from http://gpg4win.org/download.html.

  Once it’s installed, use GnuPG to import the key that signed your package. Since GnuPG for Windows is a command-line tool, you will need to use cmd.exe. Unless you edit your PATH environment variable, you will need to tell Windows the full path to the GnuPG program. If you installed GnuPG with the default values, the path should be something like this : C :\Program Files\Gnu\GnuPg\gpg.exe.

  Import Piwik Release manager Matthieu’s key (0x416F061063FEE659) by starting cmd.exe and typing :

  "C :\Program Files\Gnu\GnuPg\gpg.exe" —keyserver keys.gnupg.net —recv-keys 814E346FA01A20DBB04B6807B5DBD5925590A237

  After importing the key, you can verify that the fingerprint is correct :

  "C :\Program Files\Gnu\GnuPg\gpg.exe" —fingerprint 814E346FA01A20DBB04B6807B5DBD5925590A237

  You should see :

  pub   4096R/5590A237 2013-07-24
        Key fingerprint = 814E 346F A01A 20DB B04B  6807 B5DB D592 5590 A237
  uid                  Matthieu Aubry <matt@piwik.org>
  uid                  Matthieu Aubry <matthieu.aubry@gmail.com>
  uid                  Matthieu Aubry <matt@piwik.pro>
  sub   4096R/43F0D330 2013-07-24
  

  To verify the signature of the package you downloaded, you will need to download the ".asc" file as well. Assuming you downloaded the package and its signature to your Desktop, run :

  "C :\Program Files\Gnu\GnuPg\gpg.exe" —verify C :\Users\Alice\Desktop\piwik-2.9.0.zip.asc C :\Users\Alice\Desktop\piwik-2.9.0.zip

  The output should say "Good signature" :

  gpg : Signature made Thu 13 Nov 2014 17:42:18 NZDT using RSA key ID 5590A237
  gpg : Good signature from "Matthieu Aubry <matt@piwik.org>"
  gpg :                 aka "Matthieu Aubry <matthieu.aubry@gmail.com>"
  gpg :                 aka "Matthieu Aubry <matt@piwik.pro>"
  

  Notice that there may be a warning in case you haven’t assigned a trust index to this person. This means that GnuPG verified that the key made that signature, but it’s up to you to decide if that key really belongs to the developer. The best method is to meet the developer in person and exchange key fingerprints.

  Mac OS X and Linux

  ---

  On Linux GnuPG is usually installed by default. On Mac OS X, you need to have GnuPG installed before you can verify signatures. You can install it from http://www.gpgtools.org/.

  Once it’s installed, use GnuPG to import the key that signed your package. Matthieu Aubry signs the Piwik releases. Import his key (814E346FA01A20DBB04B6807B5DBD5925590A237) by starting the terminal (under "Applications") and typing :

  gpg —keyserver keys.gnupg.net —recv-keys 814E346FA01A20DBB04B6807B5DBD5925590A237

  After importing the key, you can verify that the fingerprint is correct :

  gpg —fingerprint 814E346FA01A20DBB04B6807B5DBD5925590A237

  You should see :

  pub   4096R/5590A237 2013-07-24
        Key fingerprint = 814E 346F A01A 20DB B04B  6807 B5DB D592 5590 A237
  uid                  Matthieu Aubry <matt@piwik.org>
  uid                  Matthieu Aubry <matthieu.aubry@gmail.com>
  uid                  Matthieu Aubry <matt@piwik.pro>
  sub   4096R/43F0D330 2013-07-24
  

  To verify the signature of the package you downloaded, you will need to download the ".asc" file as well. Assuming you downloaded the package and its signature to your Desktop, run :

  gpg —verify /Users/Alice/piwik-2.9.0.zip.asc*,

  The output should say "Good signature" :

  gpg : Signature made Thu 13 Nov 2014 17:42:18 NZDT using RSA key ID 5590A237
  gpg : Good signature from "Matthieu Aubry <matt@piwik.org>"
  gpg :                 aka "Matthieu Aubry <matthieu.aubry@gmail.com>"
  gpg :                 aka "Matthieu Aubry <matt@piwik.pro>"
  

  Notice that there may be a warning in case you haven’t assigned a trust index to this person. This means that GnuPG verified that the key made that signature, but it’s up to you to decide if that key really belongs to the developer. The best method is to meet the developer in person and exchange key fingerprints.

  That’s it ! In this article you have learnt how you can verify that the Piwik package you have downloaded on your computer was the same as the one Piwik team has officially created. We hope this helps you use Piwik with more security.

  Source : this article was copied and adapted from the great Tor Browser project website page How to verify signatures for Tor packages

• Official Piwik Training in Berlin – 2014, June 6th

  6 mai 2014, par Piwik Core Team — Community

  This event will focus on providing training to users of the Piwik analytics platform. The training will provide attendees with the necessary skills and knowledge that they will need to be able to take their website to the next level with Piwik.

  Language : English

  Register to Piwik Training now.

  Location : The 25hours Hotel Bikini Berlin is as diverse as the big city it is located in and as wild as a jungle. The hotel showcases cosmopolitan Berlin at its location in the listed Bikini-Haus building between the Tiergarten park and Breitscheidplatz with Kaiser Wilhelm Memorial Church.

  

  Why do you need training ?

  If you have just started using Piwik and are finding it a bit overwhelming, this training event will benefit you immensely. You will be able to learn all the necessary skills that will allow you move forward with Piwik.

  For users who have been using Piwik for a short time and have a bit of experience in using Piwik, you will be able to learn how to advance your skills and extend your knowledge of the Piwik platform.

  Advanced users will be able to gain more knowledge about the complex features and functions that Piwik incorporates, allowing you to customise different areas of the platform and learn about advanced topics.

  How can you benefit from this training event ?

  By understanding how Piwik works and how to use and operate Piwik more effectively, you will be able to make sound changes to your website that will allow you to achieve your business goals.

  Everyone, from ecommerce businesses to government organisations can benefit from this training event and learn the essential skills and gain the relevant knowledge to meet their goals and requirements.

  Some of the skills that you will learn during the training include :

  • How to install and get started with the Piwik platform
  • How Piwik will add value to your website
  • How to analyse and make sense of the data and information that you collect
  • How to create custom segments that will allow you to report on certain data and information
  • Advance exercises – Piwik settings, tweaking and basic diagnostics

  What equipment do I need in order to participate in the event ?

  You will need a computer that is able to connect to a Wifi network

  Are the tickets transferable ?

  Yes, the tickets are transferable.

  What is the refund policy on the tickets ?

  You are entitled to a refund up to 1 week before the commencement of the training.

  Training details

  <script type="text/javascript">          (function() { var scribd = document.createElement("script"); scribd.type = "text/javascript"; scribd.async = true; scribd.src = "#{root_url}javascripts/embed_code/inject.js"; var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(scribd, s); })()        </script>

  Contact us : contact@piwik.pro

  Registrations

  Register to Piwik Training now !

• Official Piwik Training in Berlin – 2014, June 6th

  6 mai 2014, par Piwik Core Team — Community

  This event will focus on providing training to users of the Piwik analytics platform. The training will provide attendees with the necessary skills and knowledge that they will need to be able to take their website to the next level with Piwik.

  Language : English

  Register to Piwik Training now.

  Location : The 25hours Hotel Bikini Berlin is as diverse as the big city it is located in and as wild as a jungle. The hotel showcases cosmopolitan Berlin at its location in the listed Bikini-Haus building between the Tiergarten park and Breitscheidplatz with Kaiser Wilhelm Memorial Church.

  

  Why do you need training ?

  If you have just started using Piwik and are finding it a bit overwhelming, this training event will benefit you immensely. You will be able to learn all the necessary skills that will allow you move forward with Piwik.

  For users who have been using Piwik for a short time and have a bit of experience in using Piwik, you will be able to learn how to advance your skills and extend your knowledge of the Piwik platform.

  Advanced users will be able to gain more knowledge about the complex features and functions that Piwik incorporates, allowing you to customise different areas of the platform and learn about advanced topics.

  How can you benefit from this training event ?

  By understanding how Piwik works and how to use and operate Piwik more effectively, you will be able to make sound changes to your website that will allow you to achieve your business goals.

  Everyone, from ecommerce businesses to government organisations can benefit from this training event and learn the essential skills and gain the relevant knowledge to meet their goals and requirements.

  Some of the skills that you will learn during the training include :

  • How to install and get started with the Piwik platform
  • How Piwik will add value to your website
  • How to analyse and make sense of the data and information that you collect
  • How to create custom segments that will allow you to report on certain data and information
  • Advance exercises – Piwik settings, tweaking and basic diagnostics

  What equipment do I need in order to participate in the event ?

  You will need a computer that is able to connect to a Wifi network

  Are the tickets transferable ?

  Yes, the tickets are transferable.

  What is the refund policy on the tickets ?

  You are entitled to a refund up to 1 week before the commencement of the training.

  Training details

  <script type="text/javascript">          (function() { var scribd = document.createElement("script"); scribd.type = "text/javascript"; scribd.async = true; scribd.src = "#{root_url}javascripts/embed_code/inject.js"; var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(scribd, s); })()        </script>

  Contact us : contact@piwik.pro

  Registrations

  Register to Piwik Training now !