Verifying Installer Signatures

To ensure that the software you download is authentic and has not been tampered with, all EngineeringPaper.pro desktop installers are cryptographically signed.

Windows and macOS Verification

Our .exe and .dmg installers are automatically verified by their respective operating systems.

Windows: When prompted by Microsoft Defender SmartScreen or User Account Control (UAC) during installation, the verified publisher will be explicitly listed as Engineering Paper LLC.
macOS: Our applications are signed and notarized via Apple. macOS Gatekeeper will automatically verify the developer identity (Engineering Paper LLC) and confirm the package contains no known malware before allowing the application to run.

Linux Verification (.deb and .rpm)

For Linux packages, we provide a GPG public key so you can manually verify the integrity of the downloaded packages before installing them. Our signing identity is Engineering Paper LLC <support@engineeringpaper.com>.

1. Download Our Public Key (One-Time Step)

First, download and save our public GPG key to your machine. Note: You only need to download this key and run the respective import command once. Your system will securely remember the key for all future updates.

Download the Engineering Paper LLC Public Key

Alternatively, you can download it via terminal:

wget https://pro.engineeringpaper.com/engineeringpaper-public.gpg

2. Verifying Ubuntu / Debian (.deb) Packages

Our .deb packages are verified using a detached .asc signature file.

Download both the .deb installer and the accompanying .asc signature file from the releases page.
Import our public key into your local GPG keyring (you only need to do this once):
```
gpg --import engineeringpaper-public.gpg
```
Run the verification command against the signature and the package (ensure you replace the filenames with the exact versions you downloaded):
```
gpg --verify engineeringpaper.pro_1.3.0_amd64.deb.asc engineeringpaper.pro_1.3.0_amd64.deb
```

Expected Output: You should see a line confirming a valid signature, such as:
Good signature from "Engineering Paper LLC <support@engineeringpaper.com>"

3. Verifying Fedora / RHEL (.rpm) Packages

Our .rpm packages have the GPG signature embedded directly into the file header.

Import our public key directly into your system's RPM database (you only need to do this once):
```
sudo rpm --import engineeringpaper-public.gpg
```
Verify the RPM file (ensure you replace the filename with the exact version you downloaded):
```
rpm -K engineeringpaper.pro-1.3.0-1.x86_64.rpm
```

Expected Output: You should see an output confirming the digests and signatures, such as:
digests signatures OK