GPG and checksum verification

How can I verify integrity (checksum and signature) of my downloaded Canoe installation package? You will need the GPG and/or sha256sum software. GPG is the best choice since it also verifies the signatures, but sha256sum can at least verify the checksums for downloaded files.

On Linux

GPG can be installed using the package manager of your distribution. You can add the public key of Canoe to your keyring using this command:

gpg --keyserver hkp://pgp.mit.edu --recv-keys E7ADC266

• Download the Canoe zip and the corresponding signature file to the same folder.
• Change to the download folder, or wherever you saved them, and run in terminal:

gpg --verify canoe-linux64*.zip.sig canoe-linux64*.zip
sha256sum canoe-linux64*

The results should look like this:

GPG signature

gpg: Signature made Fri 09 Mar 2018 22:30:43 UTC using RSA key ID E7ADC266
gpg: Good signature from "Göran Krampe (getcanoe.io) "
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: DEEA 6E35 887D 0F0D 1C6E  196E F48B 339E E7AD C266

sha256sum

dc92945059fed0732948589e718024f0ac1ae8f8dc11e9e5f21aebe3bf3c1156  canoe-linux64-0.3.2.zip
b82a3c026fed57e54597ee4c9f7d5660b5c8dd4e47a056631d7e9693ba36b2be  canoe-linux64-0.3.2.zip.sig

Compare the checksum printed with the relative checksum shown in the download page - they should match.

On Mac OSX

• Install GPGtools; Documentation can be found here.
• Display the Canoe public key in your browser.
• Press cmd + A to select all, then copy / paste that information into your GPG Keychain main window - that will import our public key.
• Run the following commands in Terminal.app in the download folder:

gpg --verify canoe-osx64*.zip.sig canoe-osx64*.zip
openssl sha -sha256 canoe-osx64*.zip

The results should look like this:

GPG signature

GPG: Signature made Wed Mar  7 11:24:32 2018 CET
GPG:                using RSA key F48B339EE7ADC266
GPG: Good signature from "G�ran Krampe (getcanoe.io) " [unknown]
GPG: WARNING: This key is not certified with a trusted signature!
GPG:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: DEEA 6E35 887D 0F0D 1C6E  196E F48B 339E E7AD C266

sha256sum

SHA256(canoe-linux64-0.3.2.zip)= dc92945059fed0732948589e718024f0ac1ae8f8dc11e9e5f21aebe3bf3c1156
SHA256(canoe-linux64-0.3.2.zip.sig)= b82a3c026fed57e54597ee4c9f7d5660b5c8dd4e47a056631d7e9693ba36b2b

Compare the checksum printed with the relative checksum shown in the download page - they should match.

On Windows

Feel free to contribute this section.