I am currently going through PGP & GPG book. I installed GnuPG Suit a while back but did not verify checksum nor signature. I somehow created a key. Obviously by playing around. I now want to verify that the software is authentic but don't have the dmg file. Should I delete the software and re-download? And if so, do I copy from it my keyring? Thank you.

1 Answer 1


You can try to export keys from your keyring and save them to a secure place.

As written here, https://gist.github.com/chrisroos/1205934 :

gpg --export-ownertrust > path/to/secure/directory/gpg.txt

And, to import it back, you could :

gpg --import-ownertrust your/ownertrust/gpg.txt

  • Right. Great. And I should re-install because I don't have the .dmg file which prevents me from ensuring the download is authentic, is this right? There is no other way for me to check the checksum?
    – user87589
    Commented Oct 17, 2015 at 17:11
  • 1
    If you already install gnupg suite on your computer and through it could have been corrupted or infected, you cannot trust your machine anymore
    – WayToDoor
    Commented Oct 17, 2015 at 17:25
  • The best thing to do would be to redownload the GPGsuite after a complete format. But if you're not that paranoid, you could just reinstall it safely by checking the signature of the DMG file. You can also use this GNUpg gnupg.org/download/integrity_check.html help page for more information
    – WayToDoor
    Commented Oct 17, 2015 at 17:27
  • Redownload "after a complete format" - alright, how is this different from reinstalling by checking the signature of DMG file? I don't have the DMG file. Thanks loads. I'm getting good sense from your answers already, just must verify.
    – user87589
    Commented Oct 17, 2015 at 17:42
  • What if the copy you downloaded previously had been infected by a virus on your computer ?when you'll reinstall gnupg, the malicious software can hook back on it. And the new pair of keys you'll generate could be sent to an hacker. But this is again, highly paranoid
    – WayToDoor
    Commented Oct 17, 2015 at 17:47

You must log in to answer this question.