##########################################################################
# 
# Ericsson Software Gateway Integrity Checksums 
#
# For product number: CXP1040091/11
# R-state: R11D
# 
# This file and its signature are intended to provide cryptographically
# verifiable evidence that the software originated from Ericsson 
# Software Gateway and has not been tampered with in transit. 
#
# The software to validate the signature and the certificate trust anchor
# are not included in this package; for security reasons, they must be
# acquired independently from the software deliverable. Steps 1-2 do not
# need to be repeated unless the trust anchor or validation software need 
# updating.
#
# The certificates used for signing are intended solely as technical 
# mechanisms that do not imply any acceptance of legal liability, or 
# warranty, for the products. https://www.ericsson.com/legal
#
# To validate the signature file swgw-manifest.sig:
#
# 1) Download the "Software Gateway Integrity Trust Anchor A1" certificate 
#    from the Public Key Infrastructure page
#    https://www.ericsson.com/en/about-us/enterprise-security/pki
#    to the working directory.
#
#    Filename: software_gateway_integrity_trust_anchor_a1.pem
#
# 2) Install general software for validating CMS (Cryptographic Message 
#    Syntax) signatures from a third party of your choice.
#
#    Example: OpenSSL (https://www.openssl.org/)
#
# 3) Validate the CMS signature of the manifest file. 
#
#    Example command for OpenSSL:
#    openssl cms -verify -in OMT_APPL_SW_R11D_zip.manifest.sha256.sig -binary -inform der
#      -content OMT_APPL_SW_R11D_zip.manifest.sha256 
#      -CAfile software_gateway_integrity_trust_anchor_a1.pem
#
# 4) Validate that the SHA-256 hashes below in this file match hashes of
#    the files you received from Software Gateway.
# 
#    Example command in Linux:
#    sha256sum -c OMT_APPL_SW_R11D_zip.manifest.sha256
#
#    Example command in Windows (compare hash results to list below):
#    certUtil -hashfile <downloaded file from the list> SHA256
#
#    This final step does not require checking the signature first, but
#    only the signature provides proof of software origin as it provides 
#    evidence that this file has not been modified by a third party.
# 
#######################################################################
#
10c8c0363797e881750fcbdca754742d5918fe1195fe5b292c070569738878b1  OMT_APPL_SW_R11D.zip
