docs(controller): add download verification and signature links

assets/js/tc-downloads.js

@@ -3,6 +3,7 @@
 ////////////////////////////////////////////////////////////////////////////////
 
 import { toggleModal } from './modals.js';
+import { scrollToAnchor } from './content-interactions.js';
 
 const STORAGE_KEY = 'influxdata_docs_tc_dl';
 const QUERY_PARAM = 'ref';
@@ -60,15 +61,23 @@ function stripRefParam() {
 function renderDownloadLinks(container, data) {
   const version = data.version;
   const platforms = data.platforms;
+  const digests = data.digests;
 
   let html = '<div class="tc-downloads-container">';
+  html +=
+    '<p class="tc-intro">Each platform lists the executable and its' +
+    ' detached PGP signature (<code>.asc</code>). The checksums file below' +
+    ' lists the SHA-256 checksum of every executable and is signed as' +
+    ' well. Use them to verify a download before you install it. See' +
+    ' <a href="/telegraf/controller/install/#verify-the-download-recommended">' +
+    'Verify the download</a>.</p>';
+  html +=
+    '<p class="tc-version">' +
+    `<em>Telegraf Controller v${version}</em>` +
+    '</p>';
 
   platforms.forEach((platform) => {
     html += `<h3>${platform.name}</h3>`;
-    html +=
-      '<p class="tc-version">' +
-      `<em>Telegraf Controller v${version}</em>` +
-      '</p>';
     html += '<div class="tc-build-table">';
 
     platform.builds.forEach((build) => {
@@ -77,51 +86,46 @@ function renderDownloadLinks(container, data) {
         ' class="btn tc-download-link download"' +
         ` download>${platform.name}` +
         ` (${build.arch})</a>`;
-      const sha =
-        `<code>sha256:${build.sha256}</code>` +
-        '<button class="tc-copy-sha"' +
-        ` data-sha="${build.sha256}">` +
-        '&#59693;</button>';
+      const signature =
+        `<a href="${build.signatureUrl}"` +
+        ' class="tc-signature-link"' +
+        ' download>Signature (.asc)</a>';
       html +=
         '<div class="tc-build-row">' +
         `<div class="tc-build-download">${link}</div>` +
-        `<div class="tc-build-sha">${sha}</div>` +
+        `<div class="tc-build-signature">${signature}</div>` +
         '</div>';
     });
 
     html += '</div>';
   });
 
-  container.innerHTML = html;
-}
-
-// ─── Clipboard copy ─────────────────────────────────────────────────────────
-
-function copyToClipboard(sha, button) {
-  if (navigator.clipboard && navigator.clipboard.writeText) {
-    navigator.clipboard.writeText(sha).then(() => {
-      showCopiedFeedback(button);
-    });
-  } else {
-    // Fallback for older browsers
-    const textArea = document.createElement('textarea');
-    textArea.value = sha;
-    textArea.style.position = 'fixed';
-    textArea.style.opacity = '0';
-    document.body.appendChild(textArea);
-    textArea.select();
-    document.execCommand('copy');
-    document.body.removeChild(textArea);
-    showCopiedFeedback(button);
+  if (digests) {
+    html +=
+      '<div class="tc-digests">' +
+      '<h3>Checksums</h3>' +
+      '<p>SHA-256 checksums for every executable above, signed with the' +
+      ' InfluxData package signing key.</p>' +
+      '<div class="tc-build-table">' +
+      '<div class="tc-build-row">' +
+      '<div class="tc-build-download">' +
+      `<a href="${digests.url}"` +
+      ' class="btn tc-download-link download"' +
+      ` download>${digests.filename}</a>` +
+      '</div>' +
+      '<div class="tc-build-signature">' +
+      `<a href="${digests.signatureUrl}"` +
+      ' class="tc-signature-link"' +
+      ' download>Signature (.asc)</a>' +
+      '</div>' +
+      '</div>' +
+      '</div>' +
+      '</div>';
   }
-}
 
-function showCopiedFeedback(button) {
-  const original = button.innerHTML;
-  button.innerHTML = '&#59671;';
-  setTimeout(() => {
-    button.innerHTML = original;
-  }, 2000);
+  html += '</div>';
+
+  container.innerHTML = html;
 }
 
 // ─── Marketo form ───────────────────────────────────────────────────────────
@@ -182,6 +186,18 @@ function showDownloads(area) {
   // Render download links and show the container
   renderDownloadLinks(linksContainer, data);
   linksContainer.style.display = 'block';
+
+  // The rendered links push everything below them further down the page,
+  // after the browser has already scrolled to any URL hash, so scroll again.
+  restoreHashScroll();
+}
+
+function restoreHashScroll() {
+  const hash = window.location.hash.split('?')[0];
+  if (!hash || hash === '#') return;
+  if (document.getElementById(hash.slice(1))) {
+    scrollToAnchor(hash);
+  }
 }
 
 // ─── Initialize ─────────────────────────────────────────────────────────────
@@ -204,13 +220,17 @@ function initialize() {
   // 3. Initialize Marketo form
   initMarketoForm();
 
-  // 4. Delegated click handler for SHA copy buttons
+  // 4. Links rendered inside the block that point at an anchor on this page:
+  //    scroll to the target and open it when it is an expand block, like the
+  //    site does for in-page links that exist at load time.
   area.addEventListener('click', function (e) {
-    const copyBtn = e.target.closest('.tc-copy-sha');
-    if (copyBtn) {
-      const sha = copyBtn.getAttribute('data-sha');
-      if (sha) copyToClipboard(sha, copyBtn);
-    }
+    const link = e.target.closest('a[href*="#"]');
+    if (!link) return;
+    const url = new URL(link.getAttribute('href'), window.location.href);
+    if (url.pathname !== window.location.pathname || !url.hash) return;
+    if (!document.getElementById(url.hash.slice(1))) return;
+    e.preventDefault();
+    scrollToAnchor(url.hash);
   });
 }
 

assets/styles/layouts/article/_tc-downloads.scss

@@ -8,7 +8,6 @@
   }
 
   .tc-version {
-    font-size: 1rem;
     color: rgba($article-text, .6);
     margin-bottom: .5rem;
   }
@@ -19,18 +18,22 @@
 
 
   .tc-build-row {
-    display: flex;
-    align-items: center;
+    padding: .5rem 0;
     border-bottom: 1px solid $article-hr;
 
     &:first-child {
       border-top: 1px solid $article-hr;
     }
   }
 
+  .tc-build-download,
+  .tc-build-signature {
+    display: inline-block;
+    vertical-align: middle;
+  }
+
   .tc-build-download {
-    flex: 1 1 auto;
-    margin-right: 1rem;
+    margin-right: .75rem;
   }
 
   .tc-download-link {
@@ -39,38 +42,31 @@
     white-space: nowrap;
   }
 
-  .tc-build-sha {
-    flex: 1 1 auto;
-    display: flex;
-    justify-content: flex-end;
-    gap: .1rem;
-    min-width: 0;
-    max-width: 25rem;
-
-    code {
-      font-size: .8rem;
-      padding: .15rem .65rem;
-      color: $article-code;
-      overflow: hidden;
-      text-overflow: ellipsis;
-      white-space: nowrap;
+  // Outlined counterpart of the download button: transparent background,
+  // 1px border and text in the button blue. The hover color comes from the
+  // theme (darker in the light theme, lighter in the dark theme).
+  .tc-signature-link {
+    display: inline-block;
+    padding: .35rem 1rem;
+    border: 1px solid $article-btn-outline;
+    border-radius: $radius;
+    font-size: 1rem;
+    white-space: nowrap;
+    color: $article-btn-outline;
+    background: transparent;
+    transition: color .2s, border-color .2s;
+
+    &:hover {
+      color: $article-btn-outline-hover;
+      border-color: $article-btn-outline-hover;
     }
+  }
 
-    .tc-copy-sha {
-      flex-shrink: 0;
-      background: $article-code-bg;
-      border: none;
-      border-radius: $radius;
-      padding: .2rem .6rem;
-      font-family: 'icomoon-v4';
-      font-size: .9rem;
-      color: rgba($article-code, .85);
-      cursor: pointer;
-      transition: color .2s;
-
-      &:hover {
-        color: $article-code-link-hover;
-      }
+  .tc-digests {
+    margin-top: 1.5rem;
+
+    p {
+      margin-bottom: .75rem;
     }
   }
 }
@@ -79,25 +75,17 @@
 
 @include media(small) {
   #tc-downloads-area {
-    .tc-build-row {
-      flex-direction: column;
-      align-items: flex-start;
-      gap: .5rem;
-    }
-
     .tc-build-download {
+      display: block;
       margin-right: 0;
-      width: 100%;
     }
 
     .tc-download-link {
       width: 100%;
       text-align: center;
     }
 
-    .tc-build-sha {
-      width: 100%;
-      max-width: 100%;
+    .tc-build-signature {
       margin-bottom: .5rem;
     }
   }

assets/styles/themes/_theme-dark.scss

@@ -198,6 +198,8 @@ $article-btn-gradient: $grad-blue;
 $article-btn-text: $g20-white;
 $article-btn-gradient-hover: $grad-blue-light;
 $article-btn-text-hover: $g20-white;
+$article-btn-outline: $b-pool;
+$article-btn-outline-hover: $b-hydrogen;
 
 // Article UI nav icons
 $article-nav-icon-bg: $g5-pepper;

assets/styles/themes/_theme-light.scss

@@ -198,6 +198,8 @@ $article-btn-gradient: $grad-blue !default;
 $article-btn-text: $g20-white !default;
 $article-btn-gradient-hover: $grad-blue-light !default;
 $article-btn-text-hover: $g20-white !default;
+$article-btn-outline: $b-pool !default;
+$article-btn-outline-hover: $b-ocean !default;
 
 // Article UI nav icons
 $article-nav-icon-bg: $g6-smoke !default;

content/telegraf/controller/install/_index.md

@@ -1,3 +1,3 @@
 ---
 title: Install Telegraf Controller
 description: >
@@ -90,6 +90,95 @@
 
     {{< telegraf/tc-downloads >}}
 
+    {{< expand-wrapper >}}
+    {{% expand "Verify the download <span class='req'>Recommended</span>" %}}
+
+Every release ships a detached signature (`.asc`) for each executable,
+and a `telegraf_controller-{{< latest-patch >}}.digests` file that lists
+the SHA-256 checksum of each executable and is signed as
+`telegraf_controller-{{< latest-patch >}}.digests.asc`.
+All signatures are made with the InfluxData package signing key.
+Download the signature for your executable and the two digests files
+from the download list above, then verify them before you install.
+
+{{< tabs-wrapper >}}
+{{% tabs %}}
+[Linux/macOS](#)
+[Windows](#)
+{{% /tabs %}}
+{{% tab-content %}}
+<!---------------------------- BEGIN LINUX/MACOS ----------------------------->
+
+1.  Import the InfluxData package signing key:
+
+    ```bash
+    curl -fsSL https://repos.influxdata.com/influxdata-archive.key | gpg --import
+    ```
+
+2.  Verify the signatures of the executable and of the digests file.
+    Replace `linux-x64` with the platform you downloaded.
+
+    ```bash
+    gpg --verify telegraf_controller-linux-x64.asc telegraf_controller-linux-x64
+    gpg --verify telegraf_controller-{{< latest-patch >}}.digests.asc telegraf_controller-{{< latest-patch >}}.digests
+    ```
+
+    Both commands must report a good signature from the InfluxData Package
+    Signing Key.
+
+3.  Check the executable's checksum against the digests file:
+
+    ```bash
+    sha256sum -c --ignore-missing telegraf_controller-{{< latest-patch >}}.digests
+    ```
+
+    The output lists the executable with `OK`.
+    On macOS, use `shasum -a 256 -c --ignore-missing` if `sha256sum` is not
+    installed.
+
+<!----------------------------- END LINUX/MACOS ------------------------------>
+{{% /tab-content %}}
+{{% tab-content %}}
+<!------------------------------ BEGIN WINDOWS ------------------------------->
+
+Signature verification requires GnuPG, for example
+[Gpg4win](https://www.gpg4win.org/).
+
+1.  Import the InfluxData package signing key:
+
+    ```powershell
+    Invoke-WebRequest https://repos.influxdata.com/influxdata-archive.key -OutFile influxdata-archive.key
+    gpg --import influxdata-archive.key
+    ```
+
+2.  Verify the signatures of the executable and of the digests file:
+
+    ```powershell
+    gpg --verify telegraf_controller-win-x64.exe.asc telegraf_controller-win-x64.exe
+    gpg --verify telegraf_controller-{{< latest-patch >}}.digests.asc telegraf_controller-{{< latest-patch >}}.digests
+    ```
+
+    Both commands must report a good signature from the InfluxData Package
+    Signing Key.
+
+3.  Compare the executable's checksum with the entry in the digests file:
+
+    ```powershell
+    (Get-FileHash telegraf_controller-win-x64.exe -Algorithm SHA256).Hash.ToLower()
+    Select-String telegraf_controller-win-x64.exe telegraf_controller-{{< latest-patch >}}.digests
+    ```
+
+    The two values must match.
+    The executable is also signed with an Authenticode certificate, which
+    Windows shows under **Properties > Digital Signatures**.
+
+<!------------------------------- END WINDOWS -------------------------------->
+{{% /tab-content %}}
+{{< /tabs-wrapper >}}
+
+    {{% /expand %}}
+    {{< /expand-wrapper >}}
+
 2.  **Install {{% product-name %}}**.
 
     > [!Important]