Verify Release Artifacts

To extract a .tar a file (eg. signatures.tar), use tar -xf signatures.tar.

• .zip.sig and .tar.gz.sig files are detached PGP signatures
• .zip.asc and .tar.gz.asc files are ascii-armored detached PGP signatures
• .zip and .tar.gz are archive (compressed) files containing the geth executable

To verify a release with a signature: First, make sure you have a gpg tool installed, eg. gnupg or gnupg2. Then, if you haven't already, you'll need to download and import the signing key, which you'll find here. This step is included below.

# Import signing key
$ gpg —import isaac.ardis@gmail.com
# Verify
$ gpg --verify geth-classic-osx-v5.4.1-a3d20f6.tar.gz
gpg: assuming signed data in 'geth-classic-osx-v5.4.1-a3d20f6.tar.gz'
gpg: Signature made Tue Jun  5 22:25:45 2018 CEST
gpg:                using RSA key B23DC6DC7634399484DEB8A6F36487257419D94C
gpg: Good signature from "Isaac Ardis (ETCDEV Go Developer) <isaac.ardis@gmail.com>" [ultimate]