Page History

All official releases of code distributed by the Apache Fineract Project are signed by the release manager for the release. PGP signatures and MD5 hashes are available along with the distribution.You should download the PGP signatures and MD5 hashes directly from the Apache Software Foundation rather than from mirrors. This is to help ensure the integrity of the signature files. However, you are encouraged to download the releases from our mirrors.

...

% gpg --verify apache-fineract-0.56.0-incubating-src.tar.gz.asc apache-fineract-0.56.0-incubating-src.tar.gz  
gpg: Signature made 12/07/16 16:33:37 India Standard Time using RSA key ID 0BB29444
gpg: Good signature from "Shaik Nazeer Hussain (CODE SIGNING KEY) <nazeer1100126@apache.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: AF4F D65D E78C A5B1 BF30  939F 80C4 D889 0BB2 9444

Let's verify binary release also. Download apache-fineract-0.6.0-incubating-binary.tar.gz (binary release) and its detached signature apache-fineract-0.6.0-incubating-binary.tar.gz.asc

% gpg --verify apache-fineract-0.6.0-incubating-binary.tar.gz.asc apache-fineract-0.6.0-incubating-binary.tar.gz 
  gpg: Signature made 12/07/16 16:33:37 India Standard Time using RSA key ID 0BB29444 
  gpg: Good signature from "Shaik Nazeer Hussain (CODE SIGNING KEY) <nazeer1100126@apache.org>" [unknown] 
  gpg: WARNING: This key is not certified with a trusted signature! 
  gpg: There is no indication that the signature belongs to the owner. 
  Primary key fingerprint: AF4F D65D E78C A5B1 BF30 939F 80C4 D889 0BB2 9444

At this point, the signature is (s) are good, but we don't trust this key. A good signature means that the file has not been tampered. However, due to the nature of public key cryptography, you need to additionally verify that key 0BB29444 was created by the real Shaik Nazeer Hussain.

...