Integrity Check

You can check that the version of GnuPG that you want to install is original and unmodified by either verifying the file's signature or comparing the checksum with the one published in the release announcement.

Verifying the File's Signature

If you already have a trusted version of GnuPG installed, you can check the supplied signature. For example, to check the signature of the file gnupg-2.2.43.tar.bz2, you can use this command:

$ gpg --verify gnupg-2.2.43.tar.bz2.sig gnupg-2.2.43.tar.bz2

Note: you should never use a GnuPG version you just downloaded to check the integrity of the source — use an existing, trusted GnuPG installation, e.g., the one provided by your distribution.

If the output of the above command is similar to the following, then either you don't have our distribution keys (our signing keys are here) or the signature was generated by someone else and the file should be treated suspiciously.

gpg: Signature made Fri 09 Oct 2015 05:41:55 PM CEST using RSA key ID 4F25E3B6
gpg: Can't check signature: No public key
gpg: Signature made Tue 13 Oct 2015 10:18:01 AM CEST using RSA key ID 33BD3F06
gpg: Can't check signature: No public key

If you instead see:

gpg: Good signature from "Werner Koch (dist sig)" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: D869 2123 C406 5DEA 5E0F  3AB5 249B 39D2 4F25 E3B6
gpg: Signature made Tue 13 Oct 2015 10:18:01 AM CEST using RSA key ID 33BD3F06
gpg: Good signature from "NIIBE Yutaka (GnuPG Release Key) <gniibe@fsij.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 031E C253 6E58 0D8E A286  A9F2 2071 B08A 33BD 3F06

then you have a copy of our keys and the signatures are valid, but either you have not marked the keys as trusted or the keys are a forgery. In this case, at the very least, you should compare the fingerprints that are shown to those on the signing keys page. Even better is to compare the fingerprints with those shown on our business cards, which we handout at events that we attend.

Ideally, you'll see something like:

gpg: Signature made Fri 09 Oct 2015 05:41:55 PM CEST using RSA key ID 4F25E3B6
gpg: Good signature from "Werner Koch (dist sig)" [full]
gpg: Signature made Tue 13 Oct 2015 10:18:01 AM CEST using RSA key ID 33BD3F06
gpg: Good signature from "NIIBE Yutaka (GnuPG Release Key) <gniibe@fsij.org>" [full]

This means that the signature is valid and that you trust this key (either you signed it or someone you trusted did).

Comparing Checksums

If you are not able to use an old version of GnuPG, you can still verify the file's SHA-1 checksum. This is less secure, because if someone modified the files as they were transferred to you, it would not be much more effort to modify the checksums that you see on this webpage. As such, if you use this method, you should compare the checksums with those in release announcement. This is sent to the gnupg-announce mailing list (among others), which is widely mirrored. Don't use the mailing list archive on this website, but find the announcement on several other websites and make sure the checksum is consistent. This makes it more difficult for an attacker to trick you into installing a modified version of the software.

Assuming you downloaded the file gnupg-2.2.43.tar.bz2, you can run the sha1sum command like this:

sha1sum gnupg-2.2.43.tar.bz2

and check that the output matches the SHA-1 checksum reported on this site. An example of a sha1sum output is:

0df3631bd0a38ceda6a1d4cd1ba262e3df3711c9  gnupg-2.2.43.tar.bz2

List of SHA-1 check-sums

For your convenience, all SHA-1 check-sums available for software that can be downloaded from our site, have been gathered below.

ae0935ead29a2dfa34d6b48d70808652bc3ca73b  gnupg-2.4.5.tar.bz2
9ffe88554341f28e077ef42150b149a851af2fae  gnupg-w32-2.4.5_20240307.exe
0df3631bd0a38ceda6a1d4cd1ba262e3df3711c9  gnupg-2.2.43.tar.bz2
f2368c0f6d426d3a9a37a010860d7cd9769e069a  gnupg-w32-2.2.43_20240416.exe
bf4c6725382f267b9000847db78a00174e08cb28  gnupg-desktop-2.4.3.0.tar.xz
28e216f7e10639eb1898be9bca35d13f3e0aab36  gnupg-desktop-2.4.3.0-x86_64.AppImage
6790fc3d6e7bbd7576654b43971bbe15e953ccc4  libgpg-error-1.50.tar.bz2
dd2c68e0685bb99249efeeb06046fae15b5214ba  libgcrypt-1.11.0.tar.bz2
14715e6690bc9f81d7ef17ea58805186b022f75a  libgcrypt-1.8.11.tar.bz2
781acfb012cbb5328f41efcf82f723524e8d0128  libksba-1.6.7.tar.bz2
93296e2989b0b8e762fbb18399ca41865f2445f3  libassuan-3.0.0.tar.bz2
ae52b4d49e17f17951655512949f745385804faf  ntbtls-0.3.2.tar.bz2
a9f7adc1b1f6707071d29bfb3338c28b995ca1ce  npth-1.7.tar.bz2
28effa1722865786cb984f3099a32db40f96ea26  pinentry-1.3.0.tar.bz2
b3a938939a9fb2182684aa9ba094c8e8ecd6167b  gpgme-1.23.2.tar.bz2
3f8a0ba9c7821049d51b982141a2330a246beb55  scute-1.7.0.tar.bz2
61475989acd12de8b7daacd906200e8b4f519c5a  gpa-0.10.0.tar.bz2
13747486ed5ff707f796f34f50f4c3085c3a6875  gnupg-1.4.23.tar.bz2
d4c9962179d36a140be72c34f34e557b56c975b5  gnupg-w32cli-1.4.23.exe

List of SHA-256 check-sums

For your convenience, all SHA-256 check-sums available for software that can be downloaded from our site, have been gathered below.

f68f7d75d06cb1635c336d34d844af97436c3f64ea14bcb7c869782f96f44277  gnupg-2.4.5.tar.bz2
d2ac821ceacf9409ebcdb42ae330087ada30c732981f00b356f9c2f08fac4dc1  gnupg-w32-2.4.5_20240307.exe
a3b34c40f455d93054d33cf4cf2a8ce41149d499eca2fbb759619de04822d453  gnupg-2.2.43.tar.bz2
5d0daf1f18ddf3019d7293ff99ec9da0751b70f1bb64bd2e47634fb35aad6cc6  gnupg-w32-2.2.43_20240416.exe
81e0800cc090f8f387cee8e59b9f742f2e6d2d81a408414fc051a8df64e37d90  gnupg-desktop-2.4.3.0.tar.xz
4e6592eb820a853804f9bd1f39ee545af712b0cabd0bf4a773ffddaff12fdd33  gnupg-desktop-2.4.3.0-x86_64.AppImage
69405349e0a633e444a28c5b35ce8f14484684518a508dc48a089992fe93e20a  libgpg-error-1.50.tar.bz2
09120c9867ce7f2081d6aaa1775386b98c2f2f246135761aae47d81f58685b9c  libgcrypt-1.11.0.tar.bz2
c98249fb5bb1f6017f5f9bf484327a940b59075bca7c46fa69ebb54098249860  libgcrypt-1.8.11.tar.bz2
cf72510b8ebb4eb6693eef765749d83677a03c79291a311040a5bfd79baab763  libksba-1.6.7.tar.bz2
0b160cbb898b852c6c04314b9a63e90ca87501305ad72a58a010f808665bbaf6  libassuan-3.0.0.tar.bz2
bdfcb99024acec9c6c4b998ad63bb3921df4cfee4a772ad6c0ca324dbbf2b07c  ntbtls-0.3.2.tar.bz2
8589f56937b75ce33b28d312fccbf302b3b71ec3f3945fde6aaa74027914ad05  npth-1.7.tar.bz2
9b3cd5226e7597f2fded399a3bc659923351536559e9db0826981bca316494de  pinentry-1.3.0.tar.bz2
9499e8b1f33cccb6815527a1bc16049d35a6198a6c5fae0185f2bd561bce5224  gpgme-1.23.2.tar.bz2
437fe758b27c243a5ee2535c6b065ea1d09f2c9a02d83567d2f934bb6395c249  scute-1.7.0.tar.bz2
95dbabe75fa5c8dc47e3acf2df7a51cee096051e5a842b4c9b6d61e40a6177b1  gpa-0.10.0.tar.bz2
c9462f17e651b6507848c08c430c791287cd75491f8b5a8b50c6ed46b12678ba  gnupg-1.4.23.tar.bz2