How to Verify a GPG Signature

Part 1 of 2:

Downloading What You Need

To verify your belief that someone has signed a file, you will need a copy of that person's Public Key, a copy of the file, and a copy of the signature-file that was allegedly created through the interaction of the person's Secret Key and the file.

Acquire the Public Key.
1. Import the Public Key into GPG.
Acquire a copy of the file in question.
1. Save it in a Folder.
Acquire a copy of the signature-file in question.
1. Save it in the same Folder.

Part 2 of 2:

Using GPG to Verify that someone's Secret Key Signed the File in Question

GPG will help you verify the relationship between your three files.

Open a command-line interface.
1. Change the working directory to the Folder where your file and signature-file are saved.
Verify the signature.
1. Type the following command into a command-line interface:
2. gpg --verify [signature-file] [file]
3. E.g., if you have acquired
4. (1) the Public Key 0x416F061063FEE659,
5. (2) the Tor Browser Bundle file (tor-browser.tar.gz), and
6. (3) the signature-file posted alongside the Tor Browser Bundle file (tor-browser.tar.gz.asc),
7. You would type the following:
8. gpg --verify tor-browser.tar.gz.asc tor-browser.tar.gz