0

I just downloaded gpg4win onto Windows 8.

I wanted to check the integrity, and apparently you can do so with certutil. So I navigated to my downloads folder and typed:

C:\Users\xxx\Downloads> certutil -hashfile gpg4win-3.0.2.exe sha1
SHA1 hash of file gpg4win-3.0.2.exe:
a2 da ba f0 a6 5f 3e f3 0c 60 e7 52 2f 34 59 c8 11 20 09 8e
CertUtil: -hashfile command completed successfully.

But, when I go to https://www.gpg4win.org/package-integrity.html, they display a bunch of text and even the line:

sha1_fpr: DE:16:D5:97:2F:0B:73:95:F7:D9:1E:DC:1F:21:9B:0F:FE:89:FA:B3

Doesn't agree with what certutil spat out. So my question is:

  1. Have I even used certutil correctly?, meaning the sha1 truly doesn't check out... and I should re-download the file from somewhere else, or
  2. Have I mis-used certutil / completely misunderstood the integrity checking process?
Improve this question

1 Answer 1

Reset to default
2

You did it correctly.

Scroll down a bit more and you will see

a2dabaf0a65f3ef30c60e7522f3459c81120098e  gpg4win-3.0.2.exe

Which is the same hash you got, but without the spacing.

The

sha1_fpr: DE:16:D5:97:2F:0B:73:95:F7:D9:1E:DC:1F:21:9B:0F:FE:89:FA:B3

you see is the SHA1 fingerprint (FPR) for the code signing certificate

Improve this answer
1
  • thank you so much!!! I guess I didn't scroll down cos I thought all the information was at the top. I have no idea what a fingerprint / FPR "for code signing certificate" is... another new thing to learn :)
    – yen
    Jan 2, 2018 at 7:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .