Check integrity of Gpg4win packages

How to actually perform the checks can be found e.g. on the GnuPG web page on integrity checks.

SHA1 checksums

OpenPGP signatures

For gpg4win-2.3.3.exe: https://files.gpg4win.org/gpg4win-2.3.3.exe.sig
For gpg4win-light-2.3.3.exe: https://files.gpg4win.org/gpg4win-light-2.3.3.exe.sig
For gpg4win-vanilla-2.3.3.exe: https://files.gpg4win.org/gpg4win-vanilla-2.3.3.exe.sig
For gpg4win-src-2.3.3.exe: https://files.gpg4win.org/gpg4win-src-2.3.3.exe.sig
For gpg4win-2.3.3.tar.bz2: https://files.gpg4win.org/gpg4win-2.3.3.tar.bz2.sig

The signatures have been created with the following OpenPGP certificate
Intevation File Distribution Key (Key ID: EC70B1B8)

The certificate be retrieved from OpenPGP certificate servers. Loading a certificate from a certificate server can be done e.g. via Kleopatra or GPA. Checking the signature of a file is best done with GpgEX via the Explorer.

File lengths

If you have a mismatch on the checksum or a bad signature you should first verify that you really downloaded the complete file. Here are the lengths you should get:

Code Signing Certificate

All Gpg4win exe installer files since April 2016 are signed with the following code signing certificate:

---

Previously used code signing certificates were:

and