Integrity Check

In order to check that the version of GnuPG which you are going to install is an original and unmodified one, you can do it in one of the following ways.

Using gpg

If you already have a trusted version of GnuPG installed, you can simply check the supplied signature. For example to check the signature of the file gnupg-1.4.9.tar.bz2 you would use this command:

This checks whether the signature file matches the source file. You should see a message indicating that the signature is good and made by that signing key . Make sure that you have the right key, either by checking the fingerprint of that key with other sources or by checking that the key has been signed by a trustworthy other key.

Never use a GnuPG version you just downloaded to check the integrity of the source - use an existing GnuPG installation.

Using sha1sum

If you are not able to use an old version of GnuPG, you have to verify the SHA1 checksum. Assuming you downloaded the file gnupg-1.4.9.tar.bz2, you would run the sha1sum command like this:

and check that the output matches the SHA1 checksum reported on this site. An example of sha1sum checksum is:

To be sure that this page has not been tampered, you may want to compare the list below with the one included in the announcement mail posted to several mailing list.

SHA1 Sum Summary

For your convenience, all SHA1 sums available for software that can be downloaded from our site , have been gathered below.