Veeam appliance HASH Check

[bcampbell]

We are working on setting up the VSA and getting updates working properly. We will be using an internal repository server, and I can't HASH check the 100s of files that get downloaded with every update. The repository where they are downloaded also does not have HASHs to verify either. We have a compliance requirement to HASH check any updates prior to applying them to our systems. Is there a way to HASH check and verify HASHs to the Updates prior to them getting applied to the VSA?

[vnikiforov]

Hello, Bryan,

With VBR v13.1 we added a supported option for this: the Updates Mirror in Enterprise Manager.

A custom mirror URL in the update settings of the backup server could be also specified as needed.

If you prefer you own implementation, then on that level the signature checking must be performed.
There are few options on the public Internet - for example:
Community post

or

VeeamHub GIT


Please be aware that community solutions are not officially supported by Veeam, and their proper operation can not be guaranteed in any way or form.

As for the hash checking, mirrors (and the main Veeam repository too) work through Red Hat's DNF mechanics:
gpgcheck=yes verifies every package's GPG signature (SHA256 checksum) before install and repo_gpgcheck=yes verifies the signature on the repository metadata (repomd.xml.asc). That's the "both the repository metadata and every package" signatures are checked. If signature check fails (not what is written in the repository's metadata) it will not be installed, despite of the source.