gpg --verify file.tar.xz.sig file.tar.xz

GPG Command Builder

Most GPG usage is four tasks with fiddly flags. Pick one and get the command, plus the step people skip that makes it actually work.

Leave empty to assume <file>.sig or .asc
Options
Generated command
What goes with it

"Good signature" plus a warning is normal

Verifying a download almost always prints WARNING: This key is not certified with a trusted signature, and almost everyone reads that as a failure. It is not. It means you have not personally vouched for the key in your own web of trust, which for a distribution signing key you fetched from the project website is entirely expected. The line that matters is Good signature. BAD signature means stop. The genuine weak point is how you obtained the key in the first place: a key pulled from the same page as a tampered file proves nothing.

Build GPG commands for verifying and signing

This GPG command builder covers the four things most people need GnuPG for: verifying that a downloaded file was signed by the project that published it, generating a key with an expiry and a revocation certificate, signing files and git commits, and encrypting either to a recipient public key or with a shared passphrase. It includes the surrounding steps that are easy to miss, such as importing the signing key first and setting GPG_TTY so commit signing works.

GPG FAQ

Why does verification fail with "no public key"?

You do not have the signing key, so there is nothing to check against. Import it first, ideally from the project website over HTTPS rather than a keyserver, since keyservers accept uploads from anyone and a matching name proves nothing.

What is the difference between .sig and .asc?

Both are signatures; .sig is binary and .asc is the same thing ASCII armoured so it survives email and web pages. Use --armor to produce .asc. Verification is identical either way.

Do I really need a revocation certificate?

Yes, and you need it before anything goes wrong. If your private key is lost or stolen there is no other way to tell the world the key is no longer valid; it simply stays on keyservers looking legitimate. Generate it at key creation and store it separately from the key.

Should I use GPG for encrypted messaging?

Generally no. GPG has no forward secrecy, the tooling is unforgiving, and key management defeats most people. It remains excellent for verifying software releases and signing commits, which is where the ecosystem actually depends on it.

More Linux command tools

Crontab Generator Build cron schedule expressions visually, with plain-English previews of when your job will run. tar Builder Compose tar archive and extract commands with the right compression flags, without memorizing xvzf incantations. systemd Unit Builder Generate systemd service files with restart policies, dependencies, and sandboxing options. chmod / chown Builder Work out permission octals and ownership commands with a visual rwx matrix. rsync Builder Build rsync sync and backup commands with delete safety, excludes, and SSH transport options. SSH Config Builder Generate ~/.ssh/config host blocks with keys, jump hosts, and connection keepalives. find Builder Compose find commands with type, name, time, and size filters, plus prune lists and safe actions. /etc/fstab Builder Build fstab mount lines with the right options, dump, and pass ordering for disks and network shares. OpenSSL CSR Builder Generate certificate signing request commands with subject fields and SAN entries filled in. journalctl Query Builder Compose systemd journal queries with unit, boot, priority, time-range, and grep filters. docker run Builder Build docker run commands with ports, volumes, env vars, and restart policies. Podman-compatible. ufw Rule Builder Build ufw firewall rules with allow/deny/limit actions, source restrictions, and comments. systemd Timer Builder Generate paired .timer and .service units with OnCalendar schedules, persistence, and randomised delay. WireGuard Config Generator Produce matching server and peer configs with AllowedIPs, DNS, keepalive, and NAT forwarding rules. Reverse Proxy Config Builder Write nginx or Caddy config for a self-hosted service, with TLS, WebSockets, and forwarded headers. Docker Compose Generator Build a docker-compose.yml with volumes, environment, ports, restart policy, and healthcheck. nftables Rule Builder Generate nftables rules and a stateful starter ruleset for the inet filter table. Samba and NFS Share Builder Create an smb.conf share block or an /etc/exports line, with the client mount commands. useradd / usermod Builder Build user creation and modification commands without accidentally wiping group membership. sed Command Builder Compose substitution, deletion, and insertion commands with safe in-place editing and backups. LVM Command Builder Get the full command sequence for creating, extending, and snapshotting logical volumes. restic / Borg Backup Builder Build init, backup, retention, and restore commands for restic or BorgBackup repositories. tcpdump Filter Builder Assemble BPF capture filters by host, port, and protocol, with rotation and Wireshark output. dd Bootable USB Builder Write an ISO to a USB drive, with the device identification and checksum checks to run first. ffmpeg Command Builder Convert, compress, trim, scale, and extract audio with the arguments in the right order. umask Calculator See what a umask produces for new files and directories, and where to set it persistently. Subnet Calculator Work out network, broadcast, host range, and masks for any IPv4 or IPv6 CIDR block, and split networks into subnets. curl Command Builder Build curl requests with methods, headers, JSON or form bodies, uploads, auth, retries, and timeouts. ssh-keygen Builder Generate Ed25519, RSA, or FIDO2 security key SSH keys, then install them with ssh-copy-id. sudoers Rule Builder Write sudoers.d rules with run-as targets, NOPASSWD, and limited command lists, validated with visudo. logrotate Config Generator Generate /etc/logrotate.d files with rotation schedules, retention, compression, and postrotate reloads. Podman Quadlet Generator Turn a container into a systemd service with a Quadlet .container file, rootless or rootful. Netplan Config Generator Write Netplan YAML for static IPs, DHCP, bridges, and VLANs on Ubuntu, applied safely with netplan try. grep Command Builder Build recursive grep searches with regex modes, context lines, and include or exclude filters, plus the ripgrep equivalent.

View all tools →