Verify software before installing it

Summary

A checksum compares bytes. A digital signature additionally binds signed bytes to a signing key. Reproducible builds address a further question: whether the stated source, environment and instructions produce the same artifact. These checks answer different questions, and none establishes that the program is harmless.

Before downloading

Use the project's official installation documentation to identify the supported release, platform and verification method. Record the expected signing-key identity through a channel you already trust. A checksum or key supplied only by an untrusted mirror gives that mirror too much control over the check.

Verify the release

1. Download the artifact and its verification material. Keep the exact filename and matching signature together. Tor Browser documents detached OpenPGP .asc signatures for its download files.
2. Authenticate the expected signer. Follow the project's published key-discovery and fingerprint instructions. A tool reporting a valid signature under an unexpected key is not a successful publisher check.
3. Run the documented verifier. Follow the current platform instructions, including the actual files you downloaded. Avoid copying example release numbers from an old guide.
4. Stop on a mismatch. Check that you selected the correct release and platform, then obtain fresh files through the official route. Do not bypass a failed check to finish installation.
5. Preserve the security checks after installation. Update through the project's supported mechanism and review key-change instructions when they occur.

Project-specific workflows

Tor Browser publishes GnuPG instructions and explains how to verify its detached signatures. Tails offers browser-based download verification and also publishes checksums and OpenPGP material; use the method its current installation page recommends for you.

GrapheneOS documents signature verification in its command-line installation guide and a separate web installer. Its installation instructions also require relocking the bootloader to restore full verified boot. Download verification and verified boot protect different stages. Read GrapheneOS before changing a phone's operating system.

Reproducible builds

The Reproducible Builds definition requires the same specified artifacts from the same source, build environment and instructions. F-Droid documents rebuilding APKs and comparing them using upstream signature copying; check the individual app's build metadata rather than assuming every listed app has a verified reproducible build.

Trust model / threat model

This workflow checks provenance and, where available, correspondence between source and binaries. It still depends on the expected signing key, the verification tool and a trustworthy device performing the check. For the wider chain, read hardware supply-chain trust.

Readiness and limits

Usable. The linked projects publish working verification procedures. A successful check does not replace reviewing application permissions, updating software or assessing whether the program belongs in your threat model. See Tails, Qubes and Whonix for isolation choices.

Primary sources

• Tor Browser signature verification
• Tails download verification
• GrapheneOS command-line installation and signatures
• GrapheneOS web installation and verified boot
• Reproducible Builds definition
• F-Droid reproducible builds and APK signatures
• RFC 9580: OpenPGP signatures and verification

Also in Privacy-Enhancing Cryptography