I bought a secondhand ThinkPad that currently runs Windows 11, and I want to install Fedora Workstation 44. I downloaded the ISO, checksum, and signature files from Fedora's official website. The instructions show Bash commands for verifying the GPG signature, but I only have PowerShell available. What is the easiest way to complete both the signature and checksum checks before writing the ISO to a USB drive? The checksum itself appears to match, so I mainly need guidance on the GPG/PGP verification step.
3 Answers
On Windows, Gpg4win is a practical option for checking the signature. Use it to verify the checksum file with Fedora’s signature file, then use PowerShell to hash the ISO itself: `Get-FileHash -Path "C:pathtoyourfile.iso" -Algorithm SHA256`. Compare that SHA-256 value with the checksum published by Fedora. GPG and PGP refer to closely related implementations of the same general standard.
The two checks serve different purposes: the GPG signature confirms that the checksum file was signed by the Fedora release team, while the SHA-256 hash confirms that your ISO matches the expected file and was downloaded intact. The signature check is most meaningful when you have independently established trust in the correct Fedora signing key, so it is useful but not strictly required for installation.
Fedora can also perform an image verification check after booting from the installation media. Still, verifying the downloaded files beforehand is a good precaution, especially before writing the image to a USB drive.
That makes sense. Gpg4win sounds like the simplest route for the signature check, and I can use PowerShell for the ISO hash.