#SIGNATURE ZIP FILE FOR MAC INSTALL#
#SIGNATURE ZIP FILE FOR MAC ARCHIVE#
#SIGNATURE ZIP FILE FOR MAC DOWNLOAD#
#SIGNATURE ZIP FILE FOR MAC WINDOWS#

#SIGNATURE ZIP FILE FOR MAC INSTALL#

Verification fails or fingerprint does not match!ĭo NOT install the package. It can be ignored if (and only if) you see that the fingerprints are correct (see above). The warning is there because in this example we have not taken the extra step of trusting that key. The downloaded file with a PGP key with the fingerprint BF5A669F2272CF4324C1FDA8CFB4C2166397D0D2. You want to see that 'Good signature' line. Gpg: There is no indication that the signature belongs to the owner. Gpg: WARNING: This key is not certified with a trusted signature! Gpg: Good signature from 'KeePassXC Release ' The output should look like this (the file name will differ obviously): gpg: assuming signed data in 'KeePassXC-X.X.X-Win64-Portable.zip' Signature by running the following command: $ gpg -verify KeePassXC-*.sig You can then verify the authenticity and integrity of a downloaded package from its detached This is not strictly necessary for the checks we are making here. Once you have imported the key, you can decide whether you want to mark it as trusted.

Importing the master PGP key is sufficient for verifying signatures The actual signatures are created with one of the sub keys.Īs the naming implies, they are closely related to one another. Notice that we have a master key and some sub keys. These are the fingerprints of the master key and the current signing sub keys: The KeePassXC public key can be retrieved in any of the ways shown below: From a keyserver: gpg -keyserver -recv-keys CFB4C2166397D0D2 From our website: gpg -fetch-keys GPG Tools or gnupg installed via HomeBrew.

#SIGNATURE ZIP FILE FOR MAC WINDOWS#

On Windows and macOS you will need to install the gpg program. We will use the gpg program to check the signatures.īefore you can do that you need to tell gpg about our public key, Instructions will ensure the downloaded files really came from us. Signing files with any other key will give a different signature. This contains an OpenPGP (GPG) signature created with one of our release keys. Verifying Releases via PGP - Linux, macOS, and WindowsĪ more thorough check can be made using the *.sig sidecar file. To open KeePassXC after the installation if the signature check fails. The macOS release is signed with our Apple Developer ID, which is checked by the operating system on launch. Then follow the verification instructions below.

#SIGNATURE ZIP FILE FOR MAC DOWNLOAD#

To verify the portal ZIP file, you must download and install Gpg4win. You should see the following dialog with DroidMonkey Apps, LLC as the verified publisher: The Windows MSI installation file is protected by an authenticode signature, this means that authenticity andĬhecks are verified directly by Windows when you run the program.

a self-contained executable *.AppImage for GNU/Linux.Įach of these package files has two related sidecar files, a *.sig containing a PGP signature andĪ *.DIGEST containing the SHA-256 hash for basic integrity checks.

#SIGNATURE ZIP FILE FOR MAC ARCHIVE#

an *.msi installer and a *.zip archive with binaries for Windows.

a *.dmg drag-and-drop installer for macOS.

This guarantees that the file you just downloaded was originally created by the KeePassXC Team and that itsĬontents haven't been tampered with on the way.Ī more detailed explanation is available in the Qubes-OSĮvery KeePassXC release is published in a variety of package formats: By verifying the signatures of KeePassXC releases, you can prove the authenticity and

Signature zip file for mac