sig not matching up with .exe downloads windows

[cybertron (jimbodini)]

hey,

i went to use gpg-ex to verify from the shortcut menu after downloading the windows .sig file and verify after importing the exe. It didn’t verify. Can someone please check this whenever they get a chance? I also tried decrypt and verify. I also am reporting that the checksums matched though. I think the version from memory for the pc i was fooling with is 5.012 or something thanks.

I won’t have a chance to check it until this Friday as I am away for a bit from that machine. I suppose if someone wanted me to test it earlier i could do so on the linux box i am on.

have the coolest of days,

jim

[swagner]

I fear there’s not enough information to help you.

What exactly did you download and from where?
What was the exact result of the verification?

Related topics may be:

Gpg4win installer cert

Hi all, First, many apologies if this is off-topic - I don’t seem to be able to get to file a bug as my Github account won’t talk to something called “Phabricator”… and I’m not even certain to what extent the Gpg4win projects is associated with GnuPG, though their bug report form redirects here. I’m guessing this is minor and “bookkeeping” but I’ve just pulled down the latest/new Gpg4win installer from Gpg4win.org, and the certificate it’s signed with is expired. In particular, the g10 Code G…

Serial Number mismatch between download and integrity check

Hello. I’m trying to perform an integrity check of my download of Gpg4win 4.4.1 however the serial numbers do not match between the documented integrity check of S/N: 271DF934504F8E383B33BCE5 for the current version (via Gpg4win - Check Integrity ) and the serial number listed in the installers details section of the download which is S/N: 4f7382a39e57a34e167cf912 (which looks like it’s from the previous version). I’ve re-downloaded it several times to the same outcome. Any thoughts/ideas? Than…

[cybertron (jimbodini)]

Hi the windows.exe file for 5.0.1

For gpg4win-5.0.1.exe: https://files.gpg4win.org/gpg4win-5.0.1.exe.sig

thanks

[cybertron (jimbodini)]

Verified ‘gpg4win-5.0.1.exe’ with ‘gpg4win-5.0.1.exe.sig’: The data could not be verified.

[cybertron (jimbodini)]

With unavailable certificate:
ID: 0x6DAA6E64A76D2840571B4902528897B826403ADA
You can search the certificate on a keyserver or import it from a file.

[cybertron (jimbodini)]

gpg --verify gpg4win-5.0.1.exe.sig gpg4win-5.0.1.exe
gpg: Signature made Tue 27 Jan 2026 07:14:31 AM EST
gpg: using EDDSA key 6DAA6E64A76D2840571B4902528897B826403ADA
gpg: Can’t check signature: No public key

gpg --keyserver hkps://keys.openpgp.org --recv-keys 6DAA6E64A76D2840571B4902528897B826403ADA
gpg: key 528897B826403ADA: new key but contains no user ID - skipped
gpg: Total number processed: 1
gpg: w/o user IDs: 1

thanks for any assistance,

j.

[cybertron (jimbodini)]

gpg --verify gpg4win-5.0.1.exe.sig gpg4win-5.0.1.exe
gpg: Signature made Tue 27 Jan 2026 07:14:31 AM EST
gpg: using EDDSA key 6DAA6E64A76D2840571B4902528897B826403ADA
gpg: Good signature from “Werner Koch (dist signing 2020)” [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 6DAA 6E64 A76D 2840 571B 4902 5288 97B8 2640 3ADA

so it itsnt listed on the site but this seems to work . it ummh is found on the ubuntu key server.

thanks,

j.

[bernhard (Bernhard E. Reiter)]

Hi @cybertron,

thanks for trying Gpg4win. Here are some more instructions on how to check the integrity:

From: https://gpg4win.org/package-integrity.html:

Usually you can use Microsoft’s own methods to check that the installer is signed by one of the current code signing certificates listed below.

Microsoft will normally display the code signature in an user account control dialog when you try to execute the downloaded file; alternatively you can take a look in the file properties with the explorer.

Additional methods how to check the integrity can be found on the Wiki page on integrity checks.

[..]

Since 2021 the signatures are created by one of the official GnuPG release keys (aka certificates) they can be obtained from the GnuPG Homepage or downloaded from public keyservers.

keys.openpgp.org is a single, validating keyserver. A number of experts in the GnuPG community believe that a central and validating keyserver is the wrong concept. A result of its conception is that if will not distribute user ids, unless they are “validated”.

Note that just having a public key is not enough, you also must someone get some evidence that it is from the user you believe it to be. Following a https link to the GnuPG homepage should be fine for this. Keyservers cannot really do that.

Again: Doing a GnuPG verification on the downloadable executable is not necessary at all - check the code signature, that is much easier.

Hope that answers most of your questions!
Bernhard

[cybertron (jimbodini)]

Hi Bernhard-

I didnt see the …

“Since 2021 the signatures are created by one of the official GnuPG release keys (aka certificates) they can be obtained from the GnuPG Homepage or downloaded from public keyservers.”

…listed on the main site. i must have missed it. If i did miss it, it is easy to miss because the other keys are listed on the main site at a glance from prior years.

Thank you for pointing this out. This definitely solves the perceived problem!

Sorry man…

You the bomb.com.

thanks,

j.

[bernhard (Bernhard E. Reiter)]

Hi Jimbodini,

good to hear that your problem is solved.

Thanks for the feedback, I think the link is further down on the site because most people that want to check the signature with GnuPG either have the pubkey already. (And the common case is to use the code signature.)

Best Regards,
Bernhard