GnuPG Install

In some of my recent posts I’ve been verifying the integrity of downloaded install files by comparing the checksum of the downloaded file to a known checksum. This is a great way to verify a file has not been tampered with or corrupted while being downloaded, but I needed a tool to verify the authenticity of downloaded files. To do this, I installed GnuPG via MacPorts so that I can verify digital signatures and ensure downloaded files are signed by a trusted source.

MacPorts Available Ports page

Search results for gnupg

The most recent LTS (Long Term Support) version of GnuPG is 2.2.33, so I chose the gnupg2 port.

gnupg2 port page

gnupg2 Details page

To install GnuPG via MacPorts, I had to switch to my admin account in the terminal.

Install command

gnupg2 dependencies

Output from install

After I confirmed the GnuPG install by checking the version, I also ran the list public key command to generate my .gnupg directory and files.

Some GnuPG install guides also recommend installing pinentry-mac. In the Macports gnupg2 Details page, you can see that pinentry-mac is a variant for the gnupg2 port. It’s actually a default variant, so pinentry-mac has already been installed for me.

Checked variants of gnupg2

With GnuPG installed, I can now verify the digital signatures of downloaded files. This will be an essential as I start to download more critical applications that I need to fully trust.

How often do you verify the digital signature of files you download? Do you prefer a GUI client when using GPG or PGP? Let me know by responding to this post, or you can email me at cypherbean@protonmail.com.