(Optional) Verify the installation

The AWS Copilot CLI executables are cryptographically signed using PGP signatures. The PGP signatures can be used to verify the validity of the AWS Copilot CLI executable. Use the following steps to verify the signatures using the GnuPG tool.

Download and install GnuPG. For more information, see the GnuPG website.
- For macOS, we recommend using Homebrew. Install Homebrew using the instructions from their website. For more information, see Homebrew. After Homebrew is installed, use the following command from your macOS terminal.
```
brew install gnupg
```
- For Linux systems, install gpg using the package manager on your flavor of Linux.
- For Windows systems, download and use the Windows simple installer from the GnuPG website. For more information, see GnuPG Download.

Retrieve the Amazon ECS PGP public key. You can use a command to do this or manually create the key and then import it.

Option 1: Retrieve the key with the following command.

gpg --keyserver hkps://keyserver.ubuntu.com --recv BCE9D9A42D51784F

Notes on key servers (optional)

Some alternative key servers are:
- hkps://keys.openpgp.org
- hkps://pgp.mit.edu
To switch to a different key server, verify the stored-key using this command first: gpg --keyserver ${KEYSERVER} --verbose --import-options show-only --recv BCE9D9A42D51784F.

Option 2: Create a file with the following contents of the Amazon ECS PGP public key and then import it.

The details of the Amazon ECS PGP public key for reference:

Key ID: BCE9D9A42D51784F
Type: RSA
Size: 4096/4096
Expires: Never
User ID: Amazon ECS
Key fingerprint: F34C 3DDA E729 26B0 79BE AEC6 BCE9 D9A4 2D51 784F

Import the Amazon ECS PGP public key with the following command.

gpg --import <public_key_filename>

Download the AWS Copilot CLI signatures. The signatures are ASCII detached PGP signatures stored in files with the extension .asc. The signatures file has the same name as its corresponding executable, with .asc appended.

macOSLinuxWindows

For macOS systems, run the following command.

sudo curl -Lo copilot.asc https://github.com/aws/copilot-cli/releases/latest/download/copilot-darwin.asc

For Linux systems, run the following command.

sudo curl -Lo copilot.asc https://github.com/aws/copilot-cli/releases/latest/download/copilot-linux.asc

For Windows systems, run the following command.

Invoke-WebRequest -OutFile ecs-cli.asc https://github.com/aws/copilot-cli/releases/latest/download/copilot-windows.exe

Verify the signature with the following command.

For macOS and Linux systems:

gpg --verify copilot.asc /usr/local/bin/copilot

For Windows systems:

gpg --verify ecs-cli.asc 'C:\Program Files\copilot.exe'

Expected output:

gpg: Signature made Tue Apr  3 13:29:30 2018 PDT
gpg:                using RSA key DE3CBD61ADAF8B8E
gpg: Good signature from "Amazon ECS <ecs-security@amazon.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: F34C 3DDA E729 26B0 79BE  AEC6 BCE9 D9A4 2D51 784F
     Subkey fingerprint: EB3D F841 E2C9 212A 2BD4  2232 DE3C BD61 ADAF 8B8E

Warning

The warning in the output is expected and is not problematic. It occurs because there is not a chain of trust between your personal PGP key (if you have one) and the Amazon ECS PGP key. For more information, see Web of trust.