# Verifying the package

Answers the question: How do I know the file is ours and not a substitute?

Release key fingerprint:

```
27EA 886A CD24 6DF7 9FF1  BEF5 8BBB EB61 A393 751C
```

Compare it and verify the signature before installing. The archive holds `SHA256SUMS`, the signature `SHA256SUMS.asc` and the public half of the key, `wyrd-release.asc`, next to the packages.

```
gpg --show-keys --with-fingerprint wyrd-release.asc
gpg --import wyrd-release.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missing
```

The first command prints the fingerprint, which must match the line above. `gpg --verify` answers `Good signature`, and `sha256sum -c` answers `OK` for every file.

The line `WARNING: This key is not certified with a trusted signature` is not an error.

If anything does not match, do not install the package and contact support.