How to verify a software download’s GPG signature, step by step

The three pieces

Projects usually publish the release file, a checksum file such as SHA256SUMS, and a signature of the checksum file such as SHA256SUMS.gpg or SHA256SUMS.asc. You verify the signature on the checksum file with the publisher’s public key, then verify the download against the checksums.

Getting the right key

Fetch the key from the project’s official documentation and compare the full fingerprint with at least one independent source, such as the project’s Git repository, a keyserver, or a distribution package. Never trust a key just because it was in the same directory as the download.

Lab: verify a Linux ISO

Download an Ubuntu or Debian ISO checksum file and its signature from the official site (you do not need the full ISO to practice the signature step). Import the signing key by fingerprint as documented by the project, verify the signature, then verify a downloaded file against the checksums. Read the output line that says “Good signature from” and the primary key fingerprint.

Snippet

wget https://releases.ubuntu.com/24.04/SHA256SUMS https://releases.ubuntu.com/24.04/SHA256SUMS.gpg
gpg --keyid-format long --keyserver hkps://keyserver.ubuntu.com --recv-keys <FINGERPRINT-FROM-UBUNTU-DOCS>
gpg --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missing

Reading the output

“Good signature” means the file was signed by the private key matching that public key and has not changed. “BAD signature” means the file or signature was altered: stop. The warning that the key is not certified with a trusted signature is normal unless you have signed the key yourself; it reminds you that the fingerprint check is what establishes trust. Some projects use Sigstore or minisign instead; the logic is the same.

Diagram

Verifying a release

Download
Release file, checksum file, and signature.
Get the key
Import by fingerprint from official docs; cross-check elsewhere.
Verify signature
gpg --verify SHA256SUMS.gpg SHA256SUMS
Command
```
gpg --verify SHA256SUMS.gpg SHA256SUMS
```
Verify file
sha256sum -c against the now-trusted checksums.

Check yourself

1. In a typical release, what does the GPG signature cover?

2. GPG prints “BAD signature”. What should you do?

3. What does the warning “key is not certified with a trusted signature” mean?