>

Verify GPG signatures on downloaded files

Prove a release file really came from the developer and was not modified in transit.

LinuxverifysignaturesecuritygpgLow risk
Import the project key, then run gpg --verify file.tar.gz.sig file.tar.gz and look for 'Good signature from ...'.

01Command

Command
$ gpg --verify program.tar.gz.sig program.tar.gz

02What it does

A detached signature (.sig/.asc) is a cryptographic fingerprint of the exact file, encrypted with the developer's private key. gpg --verify re-computes the fingerprint with the public key from your keyring and reports whether the file matches and who signed it. The typical flow: gpg --recv-keys <KEYID> or import a key file, then verify the signature, then optionally verify that key's fingerprint against the value published on the project's site.

03Risk

RiskLow risk
Requirementsgnupg package; preinstalled on most distros. You must have the project's public key imported first (gpg --import or gpg --recv-keys).
!Warning: 'Good signature' alone is not enough — confirm the key's fingerprint out-of-band (HTTPS site, release announcement), because anyone can generate a key with any name. An 'expired' or 'untrusted' warning usually means your local key settings, not a forged file, but never skip the fingerprint comparison.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • gpg(1) - Ubuntu manpage
    Ubuntu Manpages · community · 2026-09-17
    Evidence: Same gpg manual: --verify verifies signatures, --list-keys lists the keyring needed to make verification meaningful.
  • gpg(1) — Arch Manual Pages
    Arch Linux · community · 2026-09-17
    Evidence: Documents --verify (check a signature against a file), --list-keys and --detach-sign for detached signature workflows.

Last verified: 2026-09-19 · Category: Security & Privacy

06Related solutions

Create an SSH key pair with ssh-keygen (Ed25519)
LinuxTerminaldevelopersecurity

Generate a modern Ed25519 public/private key pair in ~/.ssh for authenticating to servers and Git platforms without passwords.

Low risk ✓ 2026-09-17
Change file permissions with chmod
LinuxFilesTerminalsecurity

Add or remove read, write, and execute permission for the owner, group, or others using symbolic or octal modes.

Medium risk ✓ 2026-09-17
Allow a port through the firewall with ufw
Linuxnetworksecurity

Add a UFW rule to permit inbound traffic on a TCP or UDP port, such as SSH on port 22.

High risk ✓ 2026-09-17