For each release, a GPG signature file (.sig) and a SHA‑256 checksum file (.sha256) are provided alongside the installation package.

Import the Release Signing Key (must be done only once)

Download the Ridom release signing key: wget https://www.ridom.de/ridom-linux-release-key.asc

Before importing the key, display its fingerprint and compare it with the fingerprint published on the download page:

gpg --show-keys --with-fingerprint ridom-linux-release-key.asc

If the fingerprints match, import the key into your local GnuPG keyring:

gpg --import ridom-linux-release-key.asc

The release signing key only needs to be imported once.

Verify the SHA‑256 Checksum

Download the package and its corresponding checksum file, then run:

sha256sum -c MBioSEQ_Ridom_Typer*.tgz.sha256

The output should contain:

MBioSEQ_Ridom_Typer*.tgz: OK

Verify the GPG Signature

Download the corresponding signature file and verify it using GnuPG:

gpg --verify MBioSEQ_Ridom_Typer*.tgz.sig MBioSEQ_Ridom_Typer*.tgz

A successful verification will show:

Good signature from "Ridom GmbH <support@ridom.de>"

You may also see the warning:

WARNING: This key is not certified with a trusted signature! There is no indication that the signature belongs to the owner.

This warning is normal if you have not explicitly trusted the release signing key. As long as the signature is reported as "Good", and the release key fingerprint matches 7A82 FEA6 1F99 196E D2D8 D0A1 779C 735B 9B4B 9ECB, the package is authentic and has not been modified since it was signed.

Summary

• SHA‑256 checksum verifies the integrity of the downloaded file.
• GPG signature verifies both integrity and authenticity.
• A Good signature result indicates that the package was signed with the expected release key and has not been tampered with.