Verifying Package Integrity Using MD5 Checksums or GnuPG The following sections describe how to use these methods. If you notice that the MD5 checksum or GPG signatures do not match, first try to download the respective package one more time, perhaps from another mirror site. After you have downloaded a MySQL package, you should make sure that its MD5 checksum matches the one provided on the MySQL download pages. Each package has an individual checksum that you can verify against the package that you downloaded. The correct MD5 checksum is listed on the downloads page for each MySQL product; you should compare it against the MD5 checksum of the file (product) that you download. Each operating system and setup offers its own version of tools for checking the MD5 checksum. Typically the command is named  md5sum , or it may be named  md5 , and some operating systems do not ship it at all. On Linux, it is part of the  GNU Text Utilities  package, which is available for a wide range of platforms. You can also download the source code from http://www.gnu.org/software/textutils/. If you have OpenSSL installed, you can use the command  openssl md5  package_name  instead. A Windows implementation of the  md5  command line utility is available from http://www.fourmilab.ch/md5/.  winMd5Sum  is a graphical MD5 checking tool that can be obtained from http://www.nullriver.com/index/products/winmd5sum. Our Microsoft Windows examples assume the name  md5.exe . Linux and Microsoft Windows examples: You should verify that the resulting checksum (the string of hexadecimal digits) matches the one displayed on the download page immediately below the respective package. Make sure to verify the checksum of the  archive file  (for example, the  .zip , .tar.gz , or  .msi  file) and not of the files that are contained inside of the archive. In other words, verify the file before extracting its contents. Another method of verifying the integrity and authenticity of a package is to use cryptographic signatures. This is more reliable than using MD5 checksums, but requires more work. We sign MySQL downloadable packages with  GnuPG  (GNU Privacy Guard).  GnuPG  is an Open Source alternative to the well-known Pretty Good Privacy ( PGP ) by Phil Zimmermann. Most Linux distributions ship with  GnuPG  installed by default. Otherwise, see http://www.gnupg.org/ for more information about  GnuPG and how to obtain and install it. To verify the signature for a specific package, you first need to obtain a copy of our public GPG build key, which you can download from http://pgp.mit.edu/. The key that you want to obtain is named  mysql- build@oss.oracle.com . Alternatively, you can copy and paste the key directly from the following text: 98 -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1 mQGiBD4+owwRBAC14GIfUfCyEDSIePvEW3SAFUdJBtoQHH/nJKZyQT7h9bPlUWC3 RODjQReyCITRrdwyrKUGku2FmeVGwn2u2WmDMNABLnpprWPkBdCk96+OmSLN9brZ fw2vOUgCmYv2hW0hyDHuvYlQA/BThQoADgj8AW6/0Lo7V1W9/8VuHP0gQwCgvzV3 BqOxRznNCRCRxAuAuVztHRcEAJooQK1+iSiunZMYD1WufeXfshc57S/+yeJkegNW shell>  md5.exe mysql-installer-community-8.0.25.msi aaab65abbec64d5e907dcd41b8699945 mysql-installer-community-8.0.25.msi shell>  md5sum mysql-standard-8.0.25-linux-i686.tar.gz aaab65abbec64d5e907dcd41b8699945 mysql-standard-8.0.25-linux-i686.tar.gz 2.1.4.1 Verifying the MD5 Checksum Note 2.1.4.2 Signature Checking Using GnuPG