[Gpg4win-users-en] Downloaded File Verification and Checksum Discrepancy

[Daniel Kahn Gillmor]

On Sat 2016-01-30 23:51:00 -0500, Veronica Cisneros wrote:
> Check sum verification returned a different checksum. Checksum stated in
> downloading page as of 01/30/2016 is
> 88d90ee9a1ea3e66b198ea866063140b882444d5
>
> When verifying the checksum of this file I get
> 4a88f90a01b0ba8e3eb0073f7b6a4bfb
>
> To verify checksum I used windows Microsoft File Checksum Integrity
> Verifier https://www.microsoft.com/en-us/download/details.aspx?id=11533

You're comparing the SHA1 digest of the file with the MD5 digest of the
file.  You should instead use something like this (from the cmd prompt):

   certutil -hashfile gpg4win-2.3.0.exe sha1
   
This question came up on the gnupg-users mailing list recently.  Please
see the thread starting at
https://lists.gnupg.org/pipermail/gnupg-users/2016-January/055050.html
for more details.

Regards,

        --dkg