===============================================================================
=================  Code Signed Informix products README file  =================
===============================================================================
To incorporate secure code signing of IBM Informix releases, the original 
tar/zip product image has been signed. A new tar/zip file of the same name has
been created that contains:

  - Original media file with the same name as the file you just extracted.
  - 3 files to be used to verify the code signature file.
    - informix.pem.cer - Certificate used to create the keys
    - informix.pem.chain - Verifies the integrity of the certificate authority
    - informix.pem.pub.key - Public key for the certificate
  - This Readme.codesign file

1. Extract the tar/zip image

2. Verify Informix code signature files using openssl, See IBM web site for
other methods of verification.

  - Verify the certificate:
    - openssl x509 -in informix.pem.cer -noout -text                          

  - Verify the public key:
    - openssl rsa -in informix.pem.pub.key -inform PEM -noout -text -pubin

  - Verify the authority chain:
    - openssl ocsp -no_nonce -issuer informix.pem.chain -cert informix.pem.cer \
              -VAfile informix.pem.chain -text -url http://ocsp.digicert.com \
              -respout ocsptest

  - Verify the product signature file using openssl:
    - openssl dgst -sha257 -verify informix.pem.pub.key -signature <tmpencode.sig> <product tar file>

You can optionally verify the contents of the public key by comparing the 
contents of the informix.pem file with the output below:

-----BEGIN PUBLIC KEY-----

5zy67mvtWPIsEarJz19p3Y0CAwEAAQ==
-----END PUBLIC KEY-----

NOTE: Even if you do not need the verification, you can still use the 
package. 

This information is also included on the Informix documentation web site.
============================ End of README.codesign2 ==========================
