How to check installer integrity with GPG on Windows

Editions: Daedalus

Instructions for Windows

1. Obtain both the Daedalus installer .exe file, and its corresponding .exe.asc signature file – put them in the same directory.
2. Obtain the GNUPG package from https://www.gpg4win.org/
3. Proceed with installation and launch the Kleopatra component.
4. Unless you already have a personal GPG key, you will have to create one (which is required for step 6):
   1. Select the menu item File -> New keypair -> Create a personal OpenPGP key pair
   2. Enter a name and an email address that suit you personally.
   3. Choose a passphrase to protect your personal key (NOTE: the passphrase can be empty, but it is not recommended if you intend to use GNUPG in future).
5. Import the IOHK key:
   1. File -> Lookup on Server
   2. Allow network access to ‘dirmngr’, if the prompt arises
   3. Search for [e-mail]
   4. Import the key
   5. Do not certify the key just yet
   6. Right-click on the key, and choose “Details”
   7. Ensure that the fingerprint is D32587D4090FE461CAEE0FF4966E5CB9CBFAA9BA

• if it’s not, the wrong key was imported, right click and delete
• if it is, we are good to go

1. Certify the IOHK key (this designates trust and is required for the next step):
   1. Once you have a personal GPG key, right-click on the imported IOHK key and choose Certify
   2. Enable the IOHK user ID
   3. Tick the I have verified the fingerprint checkbox (since you did, as per step 5), and proceed.
   4. You should receive a message saying Certification successful
2. Verify the installer binary:
   1. Click the Decrypt/Verify button on the Kleopatra toolbar
   2. Choose the Daedalus installer .exe file in the file dialog (the .asc signature file must reside in the same directory)
   3. If the verification is successful, you will receive a green-tinted message box saying:
      • Valid signature by [e-mail]
      • Date of signature
      • With certificate D325 87D4 090F E461 CAEE 0FF4 966E 5CB9 CBFA A9BA
   4. Anything else would constitute a signature verification failure.