Verifying Package Integrity Using MD5 Checksums or GnuPG Table 2.1 MySQL Package and Signature Files for Source files File Type File Name Distribution file mysql-standard-8.0.25-linux- i686.tar.gz Signature file mysql-standard-8.0.25-linux- i686.tar.gz.asc Make sure that both files are stored in the same directory and then run the following command to verify the signature for the distribution file: If the downloaded package is valid, you should see a  Good signature  message similar to this: The  Good signature  message indicates that the file signature is valid, when compared to the signature listed on our site. But you might also see warnings, like so: That is normal, as they depend on your setup and configuration. Here are explanations for these warnings: See the GPG documentation for more information on how to work with public keys. The Section 2.1.4.2, “Signature Checking Using GnuPG”  section describes how to verify MySQL downloads using GPG. That guide also applies to Microsoft Windows, but another option is to use a GUI tool like Gpg4win. You may use a different tool but our examples are based on Gpg4win, and utilize its bundled  Kleopatra  GUI. Download and install Gpg4win, and then load Kleopatra. The dialog should look similar to: 2.1.4.3 Signature Checking Using Gpg4win for Windows • WARNING: This key is not certified with a trusted signature! There is no indication that the signature belongs to the owner. : This refers to your level of trust in your belief that you possess our real public key. This is a personal decision. Ideally, a MySQL developer would hand you the key in person, but more commonly, you downloaded it. Was the download tampered with? Probably not, but this decision is up to you. Setting up a web of trust is one method for trusting them. • gpg: no ultimately trusted keys found : This means that the specific key is not "ultimately trusted" by you or your web of trust, which is okay for the purposes of verifying file signatures. shell>  gpg --verify mysql-standard-8.0.25-linux-i686.tar.gz.asc gpg: Signature made Wed 23 Jan 2013 02:25:45 AM PST using DSA key ID 5072E1F5 gpg: checking the trustdb gpg: no ultimately trusted keys found gpg: Good signature from "MySQL Release Engineering <mysql-build@oss.oracle.com>" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: A4A9 4068 76FC BD3C 4567 70C8 8C71 8D3B 5072 E1F5 shell>  gpg --verify mysql-standard-8.0.25-linux-i686.tar.gz.asc gpg: Signature made Tue 01 Feb 2011 02:38:30 AM CST using DSA key ID 5072E1F5 gpg: Good signature from "MySQL Release Engineering <mysql-build@oss.oracle.com>" shell>  gpg --verify  package_name .asc 106