How to Verify Downloads

All CSU Theory releases are cryptographically signed to ensure authenticity and integrity. Follow this guide to verify your downloads.

Why Verification Matters

Cryptographic verification ensures that the files you download are exactly what the author intended to publish, without any tampering or corruption during transmission.

  • Authenticity: Confirms the files were signed by Dr. Luke McCabe
  • Integrity: Ensures files haven't been modified since signing
  • Trust: Provides a chain of trust for scientific reproducibility

CSU Theory Public Key

Key ID:

EF0B5577FB96063B

Fingerprint:

0A82 9017 F043 5A63 A5D0 1D9C EF0B 5577 FB96 063B

Owner:

Dr. Luke McCabe (CSU Theory Signing Key) <[email protected]>

Download Public Key (csu-public-key.asc)

Step 1: Import the Public Key

First, download and import our public GPG key into your keyring.

Linux / macOS

curl -O https://csutheory.com/csu-public-key.asc
gpg --import csu-public-key.asc

Windows (using Gpg4win)

gpg --import csu-public-key.asc

Download Gpg4win from gpg4win.org

Step 2: Verify GPG Signature

Each release includes a .sig signature file. Verify it against the original file.

gpg --verify filename.sig filename

Expected Output (Good Signature)

gpg: Signature made [date]
gpg: Good signature from "Dr. Luke McCabe (CSU Theory Signing Key)"
gpg: Primary key fingerprint: 0A82 9017 F043 5A63 A5D0 1D9C EF0B 5577 FB96 063B

Step 3: Verify SHA-256 Checksum

Additionally, verify the SHA-256 checksum matches the published value on this website.

Linux

sha256sum filename

macOS

shasum -a 256 filename

Windows (PowerShell)

Get-FileHash filename -Algorithm SHA256

Compare the output hash with the SHA-256 checksum listed on the Smoking Guns Archive page.

Troubleshooting

  • "No public key" error: Make sure you've imported the public key (Step 1) before verifying.
  • "BAD signature" warning: The file may have been corrupted or tampered with. Re-download and try again. If the problem persists, do not use the file.
  • Checksum mismatch: The file was corrupted during download. Delete it and download again.