I just downloaded gpg4win onto Windows 8.

I wanted to check the integrity, and apparently you can do so with certutil. So I navigated to my downloads folder and typed:

C:\Users\xxx\Downloads> certutil -hashfile gpg4win-3.0.2.exe sha1
SHA1 hash of file gpg4win-3.0.2.exe:
a2 da ba f0 a6 5f 3e f3 0c 60 e7 52 2f 34 59 c8 11 20 09 8e
CertUtil: -hashfile command completed successfully.

But, when I go to https://www.gpg4win.org/package-integrity.html, they display a bunch of text and even the line:

sha1_fpr: DE:16:D5:97:2F:0B:73:95:F7:D9:1E:DC:1F:21:9B:0F:FE:89:FA:B3

Doesn't agree with what certutil spat out. So my question is:

  1. Have I even used certutil correctly?, meaning the sha1 truly doesn't check out... and I should re-download the file from somewhere else, or
  2. Have I mis-used certutil / completely misunderstood the integrity checking process?

You did it correctly.

Scroll down a bit more and you will see

a2dabaf0a65f3ef30c60e7522f3459c81120098e  gpg4win-3.0.2.exe

Which is the same hash you got, but without the spacing.


sha1_fpr: DE:16:D5:97:2F:0B:73:95:F7:D9:1E:DC:1F:21:9B:0F:FE:89:FA:B3

you see is the SHA1 fingerprint (FPR) for the code signing certificate

  • thank you so much!!! I guess I didn't scroll down cos I thought all the information was at the top. I have no idea what a fingerprint / FPR "for code signing certificate" is... another new thing to learn :) – yen Jan 2 '18 at 7:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.