Download

title: MacOS checksum verification instructions

SHA256 checksum can be verified using the following command:

Instead of typing the path to the Daedalus installer executable use drag and drop:

1. Open Terminal
2. Type or paste: shasum -a 256
3. Press space key
4. Drag and drop Daedalus installer from Finder to Terminal
5. Press enter key

You should see the following output, where string on the second line is the SHA256 checksum:

title: MacOS PGP signature verification instructions

1. Obtain both the Daedalus installer .pkg file and its corresponding .pkg.asc signature file – put them in the same directory.
2. If you already have the GPG Suite installed, and a personal key generated, please skip to step 5, and if not, proceed with the next step.
3. Go to https://gpgtools.org, head to the GPG Suite section, download the .dmg file and install it:
   • Right-click the .dmg file, then Open, which will open a new window with two icons: Install and Uninstall
   • Right-click the Install icon, and choose Open with.. -> Installer, which should start the GPG Suite installer
   • Follow through the installation wizard
4. Once GPG Suite installation completes, it will ask you to create a new key pair (this is required for step 6, so please don’t skip it):
   • Enter a name and an email that suit you personally.
   • Choose a passphrase to protect your personal key (NOTE: the passphrase can be empty, but it is not recommended if you intend to use this key and GPG Suite in future).
5. Import the IOHK key using the GPG Keychain application:
   • Select Key -> Lookup Key on Key Server in the application menu
   • Search for signing.authority@iohk.io
   • Choose the key with fingerprint 0171BC90 with the user ID “IOHK Signing Authority <signing.authority@iohk.io>”, then click Retrieve Key

   • Verify (right-click the imported key, then Details) that the fingerprint of the imported key is 31B3 F22F A0CC E2E8 382C 04A2 807F 2ACD 0171 BC90

   • if it’s not, the wrong key was imported, right-click and delete
   • if it is, we are good to proceed with the next step.
6. Sign the imported IOHK key (this designates trust and is required for the next step):
   • Right-click on the imported IOHK key, then “Sign”.
7. Verify the installer binary:
   • Right-click the Daedalus installer (.pkg file) in Finder (do NOT right click on the .asc file, that will not work), then select Services -> OpenPGP: Verify Signature of File (the .asc signature file must reside in the same directory)
   • The Verification Results dialog will then appear with the verdict:
     
     Trusted signature
     IOHK Signing Authority <signing.authority@iohk.io>
     CD1F 21F6 2477 EB42 D7C4 F3DE B3AD 9541 F4DB D0FE
     
     Anything different means there was no valid signature for the installer.

title: Linux checksum verification instructions

Verify the sha256 hash:

Expected:

title: Linux PGP signature verification instructions

• Obtain both the Daedalus installer .bin file, and its corresponding .bin.asc signature file -- put them in the same directory.

• Ensure that the gpg2 command is available (assuming Ubuntu Linux) in your shell, and if not -- execute the following shell command (shell commands further indicated by this bold monospace font):

  • apt-get install gnupg2

• Unless you already have a personal GPG key, create one (this is required for step 5):

  • gpg2 --generate-key
  • Supply an user ID (real name and email) that suit you personally
  • Choose a passphrase to protect your personal key (NOTE: the passphrase can be empty, but it is not recommended if you intend to use this key and GNUPG in future)

• Import the IOHK key:

  • gpg2 --keyserver hkp://keyserver.ubuntu.com/ --search-keys signing.authority@iohk.io
  • In the selection dialogue, choose the key with fingerprint 807F2ACD0171BC90

• Sign the IOHK key (this designates trust and is required for the next step):

  • gpg2 --lsign 31B3F22FA0CCE2E8382C04A2807F2ACD0171BC90

• Verify the installer binary using the .asc signature (the .asc signature file must reside in the same directory as the installer binary):

  • gpg2 --verify {{ filename }}.asc
  • Successful verification should produce a message like follows:

title: Windows checksum verification instructions

Installer integrity

SHA256 checksum can be verified using the following command:

certutil -hashfile C:\Users\YOUR_USERNAME\Downloads\{{ filename }} SHA256

Instead of typing the path to the Daedalus installer executable use drag and drop:

1. Press Windows Start Menu

2. Type cmd

3. You should see cmd.exe in the list of results. Click on cmd.exe to launch it.

4. Type or paste: certutil -hashfile

5. Press space

6. Drag and drop Daedalus installer from Explorer to Command Prompt

7. Press space

8. Type or paste: SHA256

9. Press enter key

You should see the following output, where string on the second line is the SHA256 checksum:

SHA256 hash of file C:\Users\YOUR_USERNAME\Downloads\{{ filename }}:

{{ checksum }}

CertUtil: -hashfile command completed successfully.

title: Windows PGP signature verification instructions

Windows

1. Obtain both the Daedalus installer .exe file, and its corresponding .exe.asc signature file -- put them in the same directory.

2. Obtain the GNUPG package from https://www.gpg4win.org/

3. Proceed with installation and launch the Kleopatra component.

4. Unless you already have a personal GPG key, you will have to create one (which is required for step 6):

   • Select the menu item File -> New keypair -> Create a personal OpenPGP key pair.
   • Enter a name and an email address that suit you personally.
   • Choose a passphrase to protect your personal key (NOTE: the passphrase can be empty, but it is not recommended if you intend to use GNUPG in future).

5. Import the IOHK key:

   • File -> Lookup on Server
   • Allow network access to 'dirmngr', if the prompt arises
   • Search for signing.authority@iohk.io
   • If you cannot find the key, please make sure hkp://keyserver.ubuntu.com/ (or any other maintained PGP key server of your choice) is used as Kleopatra's default key server.
   • Import the key
   • Do not certify the key just yet
   • Right-click on the key, and choose "Details"
   • Ensure that the fingerprint is 31B3F22FA0CCE2E8382C04A2807F2ACD0171BC90
   • If it's not, the wrong key was imported, right click and delete
   • If it is, we are good to go

6. Certify the IOHK key (this designates trust and is required for the next step):

   • Once you have a personal GPG key, right-click on the imported IOHK key and choose Certify
   • Enable the IOHK user ID
   • Tick the I have verified the fingerprint checkbox (since you did, as per step 5), and proceed.
   • You should receive a message saying Certification successful

7. Verify the installer binary:

   • Click the Decrypt/Verify button on the Kleopatra toolbar
   • Choose the Daedalus installer .exe file in the file dialog (the .asc signature file must reside in the same directory)

8. If the verification is successful, you will receive a green-tinted message box saying:

   • Valid signature by signing.authority@iohk.io
   • Date of signature
   • With certificate 31B3 F22F A0CC E2E8 382C 04A2 807F 2ACD 0171 BC90
   • Anything else would constitute a signature verification failure.