Checksums not matching

Just checked downloaded gpg4win-vanilla-2.2.1.exe against associated checksum using fciv and they do not match.

result is :-

1c44acd1be34b33e2693ef408e44f424 gpg4win-vanilla-2.2.1.exe

I believe it should be:-


1c44acd1be34b33e2693ef408e44f424 is the md5sum, md5 is a different hash algorithm that is mostly deprecated.

6d229b03ec2dcbb54a40f7590d108dc0cbcb5aac is the sha1 sum of gpg4win-vanilla-2.2.1.exe

I think fciv can also verify sha1sums, maybe fciv -sha1 or something.

I used fciv -sha1 gpg4win-vanilla-2.2.1.exe

I have just done it again and it worked.

Hi there

I tried this to verify hashsum on WIndows but it seems I can’t find the right hash.

C:\Users\HP User>certUtil -hashfile “C:\Users\HP User\Downloads\gpg4win-4.3.1.exe” sha1
SHA1 hash of C:\Users\HP User\Downloads\gpg4win-4.3.1.exe:
CertUtil: -hashfile command completed successfully.

expected result:

 S/N: 4F7382A39E57A34E167CF912

Issuer: CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Subject: 1.2.840.113549.1.9.1=#636F646540673130636F64652E636F6D,CN=g10 Code GmbH,O=g10 Code GmbH,L=Erkrath,ST=Nordrhein-Westfalen,C=DE
sha2_fpr: DF:B5:9B:70:5C:47:9E:4E:FF:34:AD:BF:F9:B8:DC:AF:5F:74:D3:F6:58:91:F3:8C:D1:B1:0D:C8:D3:F1:42:20
sha1_fpr: B2:85:2D:44:90:F6:55:EB:EA:DF:9F:FD:8D:09:2E:81:54:45:00:77
certid: 6E9CA841CF00ABF4F8929210FF478C9CAB578518.4F7382A39E57A34E167CF912
keygrip: A340DB2D0B82943E8AFD854C6366D5953014D583
notBefore: 2022-04-08 08:26:24
notAfter: 2025-07-02 12:12:13

I presumed the sha1 indicated should be the correct one but they don’t match

Thanks for any assistance.

You are comparing the hash of the file with the hash of the certificate. So it is expected to be different values.

See Gpg4win - Check Integrity (further down on the page) has
7c5fa919c2eb90194e844de027a36e87c7be8a80 gpg4win-4.3.1.exe
and see for more hints.

1 Like

Thanks for that.
I needed to look further.
It would be great to have some buttons at the top to point where the different checksums are.

I’m a bit fresh to all of this so easily confused. :grin:

Thanks agaim.