<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="checking-gpg-signature">
      </a>
      2.1.4.2 Signature Checking Using GnuPG
     </h4>
    </div>
   </div>
  </div>
  <p>
   Another method of verifying the integrity and authenticity of a
        package is to use cryptographic signatures. This is more
        reliable than using
   <a class="link" href="verifying-md5-checksum.html" title="2.1.4.1 Verifying the MD5 Checksum">
    MD5
        checksums
   </a>
   , but requires more work.
  </p>
  <p>
   We sign MySQL downloadable packages with
   <span class="command">
    <strong>
     GnuPG
    </strong>
   </span>
   (GNU Privacy Guard).
   <span class="command">
    <strong>
     GnuPG
    </strong>
   </span>
   is an Open Source alternative to the
        well-known Pretty Good Privacy (
   <span class="command">
    <strong>
     PGP
    </strong>
   </span>
   ) by Phil
        Zimmermann. Most Linux distributions ship with
   <span class="command">
    <strong>
     GnuPG
    </strong>
   </span>
   installed by default. Otherwise, see
   <a class="ulink" href="http://www.gnupg.org/" target="_blank">
    http://www.gnupg.org/
   </a>
   for more information about
   <span class="command">
    <strong>
     GnuPG
    </strong>
   </span>
   and how to obtain and install it.
  </p>
  <p>
   To verify the signature for a specific package, you first need
        to obtain a copy of our public GPG build key, which you can
        download from
   <a class="ulink" href="http://pgp.mit.edu/" target="_blank">
    http://pgp.mit.edu/
   </a>
   . The key that
        you want to obtain is named
   <code class="literal">
    mysql-build@oss.oracle.com
   </code>
   . The keyID for
        MySQL 8.0.36 packages and higher, and MySQL 8.3.0 and higher, is
   <code class="literal">
    A8D3785C
   </code>
   . After obtaining this key, you
        should compare it with the key following value before using it
        verify MySQL packages. Alternatively, you can copy and paste the
        key directly from the text below.
  </p>
  <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Note
   </div>
   <p>
    The public GPG build key for earlier MySQL release packages
          (keyID
    <code class="literal">
     5072E1F5
    </code>
    or
    <code class="literal">
     3A79BD29
    </code>
    ), see
    <a class="xref" href="gpg-key-archived-packages.html" title="2.1.4.5 GPG Public Build Key for Archived Packages">
     Section 2.1.4.5, “GPG Public Build Key for Archived Packages”
    </a>
    .
   </p>
  </div>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-none"><div class="docs-select-all right" id="sa51614036"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: SKS 1.1.6
Comment: Hostname: pgp.mit.edu

mQINBGU2rNoBEACSi5t0nL6/Hj3d0PwsbdnbY+SqLUIZ3uWZQm6tsNhvTnahvPPZBGdl99iW
YTt2KmXp0KeN2s9pmLKkGAbacQP1RqzMFnoHawSMf0qTUVjAvhnI4+qzMDjTNSBq9fa3nHmO
YxownnrRkpiQUM/yD7/JmVENgwWb6akZeGYrXch9jd4XV3t8OD6TGzTedTki0TDNr6YZYhC7
jUm9fK9Zs299pzOXSxRRNGd+3H9gbXizrBu4L/3lUrNf//rM7OvV9Ho7u9YYyAQ3L3+OABK9
FKHNhrpi8Q0cbhvWkD4oCKJ+YZ54XrOG0YTg/YUAs5/3//FATI1sWdtLjJ5pSb0onV3LIbar
RTN8lC4Le/5kd3lcot9J8b3EMXL5p9OGW7wBfmNVRSUI74Vmwt+v9gyp0Hd0keRCUn8lo/1V
0YD9i92KsE+/IqoYTjnya/5kX41jB8vr1ebkHFuJ404+G6ETd0owwxq64jLIcsp/GBZHGU0R
KKAo9DRLH7rpQ7PVlnw8TDNlOtWt5EJlBXFcPL+NgWbqkADAyA/XSNeWlqonvPlYfmasnAHA
pMd9NhPQhC7hJTjCiAwG8UyWpV8Dj07DHFQ5xBbkTnKH2OrJtguPqSNYtTASbsWz09S8ujoT
DXFT17NbFM2dMIiq0a4VQB3SzH13H2io9Cbg/TzJrJGmwgoXgwARAQABtDZNeVNRTCBSZWxl
YXNlIEVuZ2luZWVyaW5nIDxteXNxbC1idWlsZEBvc3Mub3JhY2xlLmNvbT6JAlQEEwEIAD4W
IQS8pDQXw7SF3RKOxtS3s7eIqNN4XAUCZTas2gIbAwUJA8JnAAULCQgHAgYVCgkICwIEFgID
AQIeAQIXgAAKCRC3s7eIqNN4XLzoD/9PlpWtfHlI8eQTHwGsGIwFA+fgipyDElapHw3MO+K9
VOEYRZCZSuBXHJe9kjGEVCGUDrfImvgTuNuqYmVUV+wyhP+w46W/cWVkqZKAW0hNp0TTvu3e
Dwap7gdk80VF24Y2Wo0bbiGkpPiPmB59oybGKaJ756JlKXIL4hTtK3/hjIPFnb64Ewe4YLZy
oJu0fQOyA8gXuBoalHhUQTbRpXI0XI3tpZiQemNbfBfJqXo6LP3/LgChAuOfHIQ8alvnhCwx
hNUSYGIRqx+BEbJw1X99Az8XvGcZ36VOQAZztkW7mEfH9NDPz7MXwoEvduc61xwlMvEsUIaS
fn6SGLFzWPClA98UMSJgF6sKb+JNoNbzKaZ8V5w13msLb/pq7hab72HH99XJbyKNliYj3+KA
3q0YLf+Hgt4Y4EhIJ8x2+g690Np7zJF4KXNFbi1BGloLGm78akY1rQlzpndKSpZq5KWw8FY/
1PEXORezg/BPD3Etp0AVKff4YdrDlOkNB7zoHRfFHAvEuuqti8aMBrbRnRSG0xunMUOEhbYS
/wOOTl0g3bF9NpAkfU1Fun57N96Us2T9gKo9AiOY5DxMe+IrBg4zaydEOovgqNi2wbU0MOBQ
b23Puhj7ZCIXcpILvcx9ygjkONr75w+XQrFDNeux4Znzay3ibXtAPqEykPMZHsZ2sbkCDQRl
NqzaARAAsdvBo8WRqZ5WVVk6lReD8b6Zx83eJUkV254YX9zn5t8KDRjYOySwS75mJIaZLsv0
YQjJk+5rt10tejyCrJIFo9CMvCmjUKtVbgmhfS5+fUDRrYCEZBBSa0Dvn68EBLiHugr+SPXF
6o1hXEUqdMCpB6oVp6X45JVQroCKIH5vsCtw2jU8S2/IjjV0V+E/zitGCiZaoZ1f6NG7ozyF
ep1CSAReZu/sssk0pCLlfCebRd9Rz3QjSrQhWYuJa+eJmiF4oahnpUGktxMD632I9aG+IMfj
tNJNtX32MbO+Se+cCtVc3cxSa/pR+89a3cb9IBA5tFF2Qoekhqo/1mmLi93Xn6uDUhl5tVxT
nB217dBT27tw+p0hjd9hXZRQbrIZUTyh3+8EMfmAjNSIeR+th86xRd9XFRr9EOqrydnALOUr
9cT7TfXWGEkFvn6ljQX7f4RvjJOTbc4jJgVFyu8K+VU6u1NnFJgDiNGsWvnYxAf7gDDbUSXE
uC2anhWvxPvpLGmsspngge4yl+3nv+UqZ9sm6LCebR/7UZ67tYz3p6xzAOVgYsYcxoIUuEZX
jHQtsYfTZZhrjUWBJ09jrMvlKUHLnS437SLbgoXVYZmcqwAWpVNOLZf+fFm4IE5aGBG5Dho2
CZ6ujngW9Zkn98T1d4N0MEwwXa2V6T1ijzcqD7GApZUAEQEAAYkCPAQYAQgAJhYhBLykNBfD
tIXdEo7G1Lezt4io03hcBQJlNqzaAhsMBQkDwmcAAAoJELezt4io03hcXqMP/01aPT3A3Sg7
oTQoHdCxj04ELkzrezNWGM+YwbSKrR2LoXR8zf2tBFzc2/Tl98V0+68f/eCvkvqCuOtq4392
Ps23j9W3r5XG+GDOwDsx0gl0E+Qkw07pwdJctA6efsmnRkjF2YVO0N9MiJA1tc8NbNXpEEHJ
Z7F8Ri5cpQrGUz/AY0eae2b7QefyP4rpUELpMZPjc8Px39Fe1DzRbT+5E19TZbrpbwlSYs1i
CzS5YGFmpCRyZcLKXo3zS6N22+82cnRBSPPipiO6WaQawcVMlQO1SX0giB+3/DryfN9VuIYd
1EWCGQa3O0MVu6o5KVHwPgl9R1P6xPZhurkDpAd0b1s4fFxin+MdxwmG7RslZA9CXRPpzo7/
fCMW8sYOH15DP+YfUckoEreBt+zezBxbIX2CGGWEV9v3UBXadRtwxYQ6sN9bqW4jm1b41vNA
17b6CVH6sVgtU3eN+5Y9an1e5jLD6kFYx+OIeqIIId/TEqwS61csY9aav4j4KLOZFCGNU0FV
ji7NQewSpepTcJwfJDOzmtiDP4vol1ApJGLRwZZZ9PB6wsOgDOoP6sr0YrDI/NNX2RyXXbgl
nQ1yJZVSH3/3eo6knG2qTthUKHCRDNKdy9Qqc1x4WWWtSRjh+zX8AvJK2q1rVLH2/3ilxe9w
cAZUlaj3id3TxquAlud4lWDz
=h5nH
-----END PGP PUBLIC KEY BLOCK-----</code></pre>
  </div>
  <p>
   To import the build key into your personal public GPG keyring,
        use
   <span class="command">
    <strong>
     gpg --import
    </strong>
   </span>
   . For example, if you have
        saved the key in a file named
   <code class="filename">
    mysql_pubkey.asc
   </code>
   , the import command looks
        like this:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa57803534"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">gpg</span> <span class="token property">--import</span> mysql_pubkey<span class="token punctuation">.</span>asc
gpg<span class="token punctuation">:</span> key B7B3B788A8D3785C<span class="token punctuation">:</span> public key "MySQL Release Engineering
&lt;mysql-build@oss<span class="token punctuation">.</span>oracle<span class="token punctuation">.</span>com&gt;" imported
gpg<span class="token punctuation">:</span> Total number processed<span class="token punctuation">:</span> 1
gpg<span class="token punctuation">:</span>               imported<span class="token punctuation">:</span> 1</code></pre>
  </div>
  <p>
   You can also download the key from the public keyserver using
        the public key id,
   <code class="literal">
    A8D3785C
   </code>
   :
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa2715482"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">gpg</span> <span class="token property">--recv-keys</span> A8D3785C
gpg<span class="token punctuation">:</span> requesting key A8D3785C from hkp server keys<span class="token punctuation">.</span>gnupg<span class="token punctuation">.</span>net
gpg<span class="token punctuation">:</span> key A8D3785C<span class="token punctuation">:</span> <span class="token atrule">"MySQL Release Engineering &lt;mysql-build@oss.oracle.com&gt;"</span>
1 new user ID
gpg<span class="token punctuation">:</span> key A8D3785C<span class="token punctuation">:</span> <span class="token atrule">"MySQL Release Engineering &lt;mysql-build@oss.oracle.com&gt;"</span>
53 new signatures
gpg<span class="token punctuation">:</span> no ultimately trusted keys found
gpg<span class="token punctuation">:</span> Total number processed<span class="token punctuation">:</span> 1
gpg<span class="token punctuation">:</span>           new user IDs<span class="token punctuation">:</span> 1
gpg<span class="token punctuation">:</span>         new signatures<span class="token punctuation">:</span> 53</code></pre>
  </div>
  <p>
   If you want to import the key into your RPM configuration to
        validate RPM install packages, you should be able to import the
        key directly:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa44017767"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">rpm</span> <span class="token property">--import</span> mysql_pubkey<span class="token punctuation">.</span>asc</code></pre>
  </div>
  <p>
   If you experience problems or require RPM specific information,
        see
   <a class="xref" href="checking-rpm-signature.html" title="2.1.4.4 Signature Checking Using RPM">
    Section 2.1.4.4, “Signature Checking Using RPM”
   </a>
   .
  </p>
  <p>
   After you have downloaded and imported the public build key,
        download your desired MySQL package and the corresponding
        signature, which also is available from the download page. The
        signature file has the same name as the distribution file with
        an
   <code class="filename">
    .asc
   </code>
   extension, as shown by the examples
        in the following table.
  </p>
  <div class="table">
   <a name="idm46045332876896">
   </a>
   <p class="title">
    <b>
     Table 2.1 MySQL Package and Signature Files for Source files
    </b>
   </p>
   <div class="table-contents">
    <table>
     <colgroup>
      <col style="width: 25%"/>
      <col style="width: 75%"/>
     </colgroup>
     <thead>
      <tr>
       <th>
        File Type
       </th>
       <th>
        File Name
       </th>
      </tr>
     </thead>
     <tbody>
      <tr>
       <td>
        Distribution file
       </td>
       <td>
        <code class="literal">
         mysql-8.4.3-linux-glibc2.28-x86_64.tar.xz
        </code>
       </td>
      </tr>
      <tr>
       <td>
        Signature file
       </td>
       <td>
        <code class="literal">
         mysql-8.4.3-linux-glibc2.28-x86_64.tar.xz.asc
        </code>
       </td>
      </tr>
     </tbody>
    </table>
   </div>
  </div>
  <br class="table-break"/>
  <p>
   Make sure that both files are stored in the same directory and
        then run the following command to verify the signature for the
        distribution file:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting one-line language-terminal"><div class="docs-select-all right" id="sa59746146"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">gpg</span> <span class="token property">--verify</span> <em class="replaceable">package_name</em><span class="token punctuation">.</span>asc</code></pre>
  </div>
  <p>
   If the downloaded package is valid, you should see a
   <code class="literal">
    Good signature
   </code>
   message similar to this:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa40195091"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">gpg</span> <span class="token property">--verify</span> mysql-8<span class="token punctuation">.</span>4<span class="token punctuation">.</span>3-linux-glibc2<span class="token punctuation">.</span>28-x86_64<span class="token punctuation">.</span>tar<span class="token punctuation">.</span>xz<span class="token punctuation">.</span>asc
gpg<span class="token punctuation">:</span> Signature made Fri 15 Dec 2023 06<span class="token punctuation">:</span>55<span class="token punctuation">:</span>13 AM EST
gpg<span class="token punctuation">:</span>                using RSA key BCA43417C3B485DD128EC6D4B7B3B788A8D3785C
gpg<span class="token punctuation">:</span> Good signature from <span class="token atrule">"MySQL Release Engineering &lt;mysql-build@oss.oracle.com&gt;"</span></code></pre>
  </div>
  <p>
   The
   <code class="literal">
    Good signature
   </code>
   message indicates that the
        file signature is valid, when compared to the signature listed
        on our site. But you might also see warnings, like so:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa40189226"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal"><span class="token prompt">$&gt; </span><span class="token command">gpg</span> <span class="token property">--verify</span> mysql-8<span class="token punctuation">.</span>4<span class="token punctuation">.</span>3-linux-glibc2<span class="token punctuation">.</span>28-x86_64<span class="token punctuation">.</span>tar<span class="token punctuation">.</span>xz<span class="token punctuation">.</span>asc
gpg<span class="token punctuation">:</span> Signature made Fri 15 Dec 2023 06<span class="token punctuation">:</span>55<span class="token punctuation">:</span>13 AM EST
gpg<span class="token punctuation">:</span>                using RSA key BCA43417C3B485DD128EC6D4B7B3B788A8D3785C
gpg<span class="token punctuation">:</span> Good signature from <span class="token atrule">"MySQL Release Engineering &lt;mysql-build@oss.oracle.com&gt;"</span>
gpg<span class="token punctuation">:</span> WARNING<span class="token punctuation">:</span> This key is not certified with a trusted signature!
gpg<span class="token punctuation">:</span>          There is no indication that the signature belongs to the owner<span class="token punctuation">.</span>
Primary key fingerprint<span class="token punctuation">:</span> BCA4 3417 C3B4 85DD 128E  C6D4 B7B3 B788 A8D3 785C</code></pre>
  </div>
  <p>
   That is normal, as they depend on your setup and configuration.
        Here are explanations for these warnings:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <span class="emphasis">
       <em>
        gpg: no ultimately trusted keys found
       </em>
      </span>
      :
            This means that the specific key is not "ultimately trusted"
            by you or your web of trust, which is okay for the purposes
            of verifying file signatures.
     </p>
    </li>
    <li class="listitem">
     <p>
      <span class="emphasis">
       <em>
        WARNING: This key is not certified with a trusted
            signature! There is no indication that the signature belongs
            to the owner.
       </em>
      </span>
      : This refers to your level of trust
            in your belief that you possess our real public key. This is
            a personal decision. Ideally, a MySQL developer would hand
            you the key in person, but more commonly, you downloaded it.
            Was the download tampered with? Probably not, but this
            decision is up to you. Setting up a web of trust is one
            method for trusting them.
     </p>
    </li>
   </ul>
  </div>
  <p>
   See the GPG documentation for more information on how to work
        with public keys.
  </p>
 </div>
 <br/>
</div>
