How to Verify Newsboat Release Downloads with OpenPGP

Updated

Newsboat release files are published with a detached OpenPGP signature (the .asc file listed next to each tar.xz), and the project publishes its signing key fingerprint so you can confirm you have the right key before trusting a download. The official key is 4ED6CD61932B9EBE, with fingerprint B8B1 756A 0DDB F076 0CE6 7CCF 4ED6 CD61 932B 9EBE, downloadable from keys.openpgp.org or directly from the project. Verification is worth doing whenever you fetch a tarball from a mirror, a package cache, or any path other than the project's own release links.

What you need before starting

  • The release tarball, for example newsboat-2.45.tar.xz (current version 2.45, released 4 October 2026).
  • The matching signature file, for example newsboat-2.45.tar.xz.asc. Older releases are listed the same way — 2.44, 2.43, 2.42, and so on each have a tar.xz and an asc.
  • GnuPG (gpg) installed on your machine.
  • The official fingerprint from the project page, so you can check the key you import rather than trusting whatever a keyserver returns.

Step 1: Get the official public key

Download the key from keys.openpgp.org or directly from the project, then import it:

gpg --import newsboat-key.asc

If you pull it from a keyserver instead, request it by the key ID and then verify the fingerprint in the next step — a keyserver lookup alone does not prove the key belongs to Newsboat.

Step 2: Confirm the fingerprint

List the imported key and compare the fingerprint character by character against the published value:

gpg --fingerprint 4ED6CD61932B9EBE

Expected output includes:

B8B1 756A 0DDB F076 0CE6 7CCF 4ED6 CD61 932B 9EBE

If the fingerprint differs in any group, stop. You are not holding the project's key, and any signature check that follows would be meaningless.

Step 3: Verify the signature against the tarball

With the key confirmed, run the verification in the directory holding both files:

gpg --verify newsboat-2.45.tar.xz.asc newsboat-2.45.tar.xz

Expected result: a line reporting a good signature made by the Newsboat key, followed by the key ID. A "good signature" message means the file matches what was signed and has not been altered since. A warning that the key is not certified with a trusted signature is normal for a key you have not personally signed; the fingerprint check in Step 2 is what covers that gap.

Reading the result

Output Meaning Action
Good signature, key ID matches 4ED6CD61932B9EBE File is intact and signed by the project key Proceed to extract and build
Good signature, unexpected key ID Signed by a different key Do not trust; re-download from the project
BAD signature File contents do not match the signature Discard the file and download again
No public key Key not imported Return to Step 1

Common snags

  • Signature file missing. Each release lists tar.xz and asc separately; if your mirror only carries the tarball, fetch the .asc from the project's own release listing.
  • Wrong working directory. gpg --verify needs the signature file first and the signed file second, both reachable by the paths you give. Run it where both sit, or pass full paths.
  • Assuming a keyserver import is enough. Importing by key ID does not verify ownership. The fingerprint comparison is the step that does.
  • Old releases. The same key and the same procedure apply to earlier versions such as 2.44, 2.43, or 2.42; only the filenames change.

Reporting a security problem

If verification leads you to a genuine security issue rather than a download problem, report it to [email protected], encrypting the message with the same OpenPGP key if possible. That address is the project's stated channel for vulnerabilities, separate from the GitHub issue tracker and the mailing list at [email protected].