{"id":2257,"date":"2023-07-03T04:46:16","date_gmt":"2023-07-03T04:46:16","guid":{"rendered":"https:\/\/signmycode.com\/resources\/?p=2257"},"modified":"2025-02-17T10:57:16","modified_gmt":"2025-02-17T10:57:16","slug":"steps-to-verify-the-digital-signature-of-a-file-in-windows-and-linux","status":"publish","type":"post","link":"https:\/\/signmycode.com\/resources\/steps-to-verify-the-digital-signature-of-a-file-in-windows-and-linux","title":{"rendered":"How to Verify the Digital Signature of a File in Windows and Linux?"},"content":{"rendered":"\n

Safeguarding your downloaded files and programs is essential to protect against malware and ensure their authenticity. Learn how to verify file signatures to confirm if your files have been compromised since they were signed.<\/p>\n\n\n\n

You can rely on digital signatures to ensure safety and integrity for software programs and updates. These cryptographic data blocks validate files’ origins, authenticity, and integrity.<\/p>\n\n\n\n

This guide will help you verify file signatures in Linux and Windows, empowering you to download software confidently. Let’s enhance your software downloads.<\/p>\n\n\n\n

Why Must You Check the File Signatures?<\/h2>\n\n\n\n

Ransomware attacks targeted 67% of organizations surveyed by Fortinet in 2023, with a disheartening 65% unable to recover their data fully<\/strong>.<\/em><\/p>\n\n\n\n

Cybercriminals continue to employ cunning methods, exploiting user trust in reputable brands like Microsoft OneNote and Adobe Acrobat Sign. Their deceptive tactics involve sending malicious attachments to trick users into downloading and opening infected files.<\/p>\n\n\n\n

Verifying a file’s digital signature is vital in protecting your devices and organization from the risks associated with downloading compromised code. So, how can you do it? Let’s break it down.<\/p>\n\n\n\n

Verifying Digital Signatures in Linux:<\/h2>\n\n\n\n

Don’t assume Linux is immune to malware infections. Elastic Security Lab’s latest report revealed that Linux endpoints were targeted in over 54% of malware infections in 2022<\/em><\/strong>.<\/p>\n\n\n\n

Once regarded as a safe haven, Linux is now subject to rapidly changing threats. To counter cyber risks, more efforts are needed to verify a file’s checksum, ensuring file integrity. You should also check its digital signature.<\/p>\n\n\n\n

Recommended:<\/strong> Examples of Digital Signatures & Certificates for Organizations<\/a><\/p>\n\n\n\n

Let’s consider an example where you want to install software, such as VeraCrypt, a multiplatform, open-source disk encryption tool that isn’t available in Linux repositories. <\/p>\n\n\n\n

After downloading the Linux package from the official website, you must follow the steps to verify the file’s digital signature (VeraCrypt employs PGP and X.509 digital signatures).<\/p>\n\n\n\n

While these steps apply to most signed software, some exceptional cases may involve variations. For instance, the public key or the PGP signature file might be stored elsewhere or included in a bundle.<\/p>\n\n\n\n

By adhering to these procedures, you can ensure the integrity and authenticity of the files you download, mitigating the risks of malware and tampering. Stay vigilant against cybercriminals who exploit user trust, and prioritize protecting your data and systems in today’s ever-evolving digital landscape.<\/p>\n\n\n\n

Checking a file’s digital signature can help safeguard your devices and organization from compromised code. Follow the steps below to verify digital signatures in Windows and Linux environments.<\/p>\n\n\n\n

Know if Gnu Privacy Guard (GnuPG or GPG) is already in your Linux:<\/h2>\n\n\n\n

Confirm GPG is installed on your system by downloading the publisher’s public key and importing it into your local keyring, following these steps:<\/p>\n\n\n\n

Step 1:<\/mark><\/strong> Open a terminal window by pressing Ctrl+Alt+T<\/strong>.<\/p>\n\n\n\n

Step 2: <\/mark><\/strong>Type the following command and press Enter to check if GnuPG is already installed:<\/p>\n\n\n\n

gpg --version<\/code><\/pre>\n\n\n\n
If the installed version of GnuPG is displayed, you can proceed to the next step. If you receive an error message such as “command not found<\/strong>,” it means GnuPG is not installed, and you need to install it for further verification.<\/p>\n\n\n\n
Step 3:<\/mark><\/strong> Install GnuPG<\/strong> by running the following commands in the terminal:<\/p>\n\n\n\n
sudo apt-get update\nsudo apt-get install gnupg<\/code><\/pre>\n\n\n\n
Enter your system password when prompted, and the installation process will begin. Follow any additional instructions provided by the package manager.<\/p>\n\n\n\n
Step 4: <\/mark><\/strong>Once GnuPG is installed, you can download the publisher’s public key. On the software download page, locate the publisher’s public key link<\/strong>. Right-click on the link and select “Copy<\/strong>” to copy the link to your clipboard.<\/p>\n\n\n\n
Step 5: <\/mark><\/strong>In the terminal, navigate to the directory where you want to download the public key. Use the “cd<\/strong>” command followed by the path to the desired folder.<\/p>\n\n\n\n
Step 6: <\/mark><\/strong>Type the following command in the terminal, replacing “link<\/strong>” with the actual link to the public key you copied:<\/p>\n\n\n\n
wget [link]<\/code><\/pre>\n\n\n\n
Press Enter to execute the command, and the public key file will be downloaded to your current directory.<\/p>\n\n\n\n
Step 7: <\/mark><\/strong>To import the public key into your local keyring, navigate to the directory where you downloaded the key using the “cd<\/strong>” command.<\/p>\n\n\n\n
Step 8: <\/mark><\/strong>Type the following command in the terminal, replacing “filename” with the name of the downloaded public key file:<\/p>\n\n\n\n
gpg --import filename<\/code><\/pre>\n\n\n\n
Press Enter to import the key into your local keyring.<\/p>\n\n\n\n
Step 9: <\/mark><\/strong>Verifying the downloaded public key’s fingerprint<\/strong> ensures its authenticity and integrity. Navigate to the directory where you downloaded the key using the “cd” <\/strong>command.<\/p>\n\n\n\n
Step 10:<\/mark><\/strong> Type the following command in the terminal to view the fingerprints in your local keyring:<\/p>\n\n\n\n
gpg --fingerprint<\/code><\/pre>\n\n\n\n
Compare the fingerprint displayed with the one published on the website from which you downloaded the key. Make sure these match to ensure the key’s authenticity and integrity.<\/p>\n\n\n\n
Now, continue the steps below to download the Pretty Good Privacy (PGP) signature file and verify the installer’s signature. Follow these steps:<\/p>\n\n\n\n
Steps to Download PGP Signature File and Verify the Installer’s Signature<\/h3>\n\n\n\n
Step 1:<\/mark><\/strong> Locate the PGP signature file link<\/strong> related to the software you downloaded. Click on it and save it on your device<\/strong>. In this example, we’ll assume you’re downloading the PGP signature file for Ubuntu 20.<\/p>\n\n\n\n
Step 2: <\/mark><\/strong>Navigate to the folder where you saved the installer and the PGP signature file. For instance, if you saved them in the Download folder, open a terminal and navigate to that directory using the “cd”<\/strong> command.<\/p>\n\n\n\n
Step 3: <\/mark><\/strong>To verify the signature of the installer<\/strong>, use the following command in the terminal:<\/p>\n\n\n\n
gpg --verify [installer].sig [installer]<\/code><\/pre>\n\n\n\n
QUICK NOTE:<\/strong> Replace \u2018[installer].sig\u2019 with the filename of the PGP signature file, and replace \u2018[installer]\u2019 with the filename of the installer file.<\/p>\n\n\n\n
Step 4: <\/mark><\/strong>If the command output displays “Good signature<\/strong>” the file hasn’t been modified since it was signed, and you can install it confidently.<\/p>\n\n\n\n
Step 5:<\/mark> <\/strong>In some cases, you may see a message like<\/p>\n\n\n\n
“WARNING<\/strong>: This key is not certified with a trusted signature! There is no indication that the signature belongs to the owner” after the “Good signature” message.<\/p>\n\n\n\n
This informational message indicates that you must still sign Veracrypt’s key to mark it as trusted. According to Ubuntu.com, this is not a cause for concern. VeraCrypt.eu states that you need to sign the imported key to avoid seeing an error message about the signing key being invalid.<\/p>\n\n\n\n
Step 6:<\/mark> <\/strong>If you receive a “BAD signature<\/strong>” message when running the verification command, it indicates something is wrong with the signature, and you should proceed with caution.<\/p>\n\n\n\n
These steps guarantee that the software you’re installing is original and hasn’t been modified by malicious actors.<\/p>\n\n\n\n
Checking Digital In Linux:<\/h3>\n\n\n\n
Step 1:<\/strong> <\/mark>Open a terminal.<\/p>\n\n\n\n
Step 2:<\/mark><\/strong> Use the \u2018gpg<\/strong>\u2019 command to check the signature. The \u2018gpg\u2019 command is usually pre-installed in most Linux distributions. If you don’t have it, install it using the package manager specific to your distribution.<\/p>\n\n\n\n
gpg --verify <file>.sig <file><\/code><\/pre>\n\n\n\n
Replace \u2018<file>.sig<\/strong>\u2019 with the signature file and \u2018<file><\/strong>\u2019 with the file you want to verify. Ensure the signature file is in the same directory as the file you want to check.<\/p>\n\n\n\n
Step 3:<\/strong> <\/mark>The \u2018gpg<\/strong>\u2019 command will output the verification result. If the signature is valid and the file hasn’t been tampered with, you will see a “Good signature” message.<\/p>\n\n\n\n
Know if Gnu Privacy Guard (GnuPG or GPG) is already in your Windows:<\/h2>\n\n\n\n
Checking the digital signature of a file in Windows 10 is a straightforward process. Let’s use File Explorer, a built-in feature that requires no additional software. <\/p>\n\n\n\n
In this example, we’ll demonstrate how to verify the X.509 digital signature of the communication application Slack.<\/strong><\/p>\n\n\n\n
First, locate the Installer File.<\/p>\n\n\n\n
After downloading the installer file:<\/strong><\/p>\n\n\n\n