How to verify Eddie downloads with OpenPGP (GPG) signatures

We sign every release file with OpenPGP. Verifying the signature ensures the file was not modified in transit and comes from us. This page explains how to verify the signature on Windows, MacOS, and Linux.

You need GnuPG installed. If it is not already there, install it as follows.

Windows

Download and install Gpg4win from gpg4win.org. During setup you can leave default options. After installation, open Command Prompt or PowerShell and run:

gpg --version

If you see version information, GnuPG is ready.

MacOS

Install via Homebrew (if you use it):

brew install gnupg

Or download GPG Suite from gpgtools.org. Then open Terminal and run:

gpg --version

Linux

Install the gnupg package. Examples:

# Debian / Ubuntu
sudo apt install gnupg

# Fedora / RHEL
sudo dnf install gnupg2

# Arch
sudo pacman -S gnupg

Then run gpg --version to confirm.

Import our public key

You only need to do this once (or again if we rotate the key). We publish our release signing key; you import it so GPG can verify our signatures.

Download our public key file from the website. In a terminal or command prompt, go to the folder where you saved it and run:

gpg --import eddie_maintainer_gpg.key

Fingerprint:

239F D950 7903 EA9F BF7D  CCF1 C6E3 3885 8A23 9AEC

Download the package and its signature

From the download page, download both:

The release file (e.g. eddie-ui2.25.0linuxx64debian.deb, or the .zip, .dmg, .pkg, .tar.gz for your platform).
The signature file: click the link that downloads the .asc file for the same release (same name with .asc at the end).

Save both files in the same folder (e.g. your Downloads folder).

Verify the signature

Open a terminal (or Command Prompt / PowerShell on Windows) and change to the folder where you saved the two files. Then run:

gpg --verify filename.asc filename

Use the real file names. The .asc file is the signature; the other is the package. Examples:

Windows

Example if both files are in Downloads (use your real package name):

cd %USERPROFILE%\Downloads
gpg --verify your-package.exe.asc your-package.exe

MacOS

Example if both files are in your Downloads folder (use your real package name):

cd ~/Downloads
gpg --verify your-package.dmg.asc your-package.dmg

Linux

Example with a Debian package:

cd ~/Downloads
gpg --verify eddie-ui_2.25.0_linux_x64_debian.deb.asc eddie-ui_2.25.0_linux_x64_debian.deb

What the result means

Good signature

You should see a line like:

gpg: Good signature from "Eddie <apt@eddie.website>"

There may be a warning that the key is not certified with a trusted signature; that is normal if you have not marked our key as ultimately trusted. The important part is Good signature. You can then install or use the downloaded file.

Bad signature or tampering

If you see BAD signature, do not use the file. Delete it and download again from the official site; if it still fails, contact support.

Missing public key

If GPG says it cannot verify because no public key was found, import our public key (see Import our public key above). The message will include the key ID; you can import that key from a keyserver or from our key file.