Linux: checking a download
Each Linux download (the AppImage and the .deb) has a detached GPG signature (an .asc file), linked next to it on the download page, and a SHA-256 checksum, listed on the same page. Check the signature before you run or install the file.
The examples use the AppImage. For the .deb, use its file name and its .asc instead.
Check the signature
# 1. Import the release key (once)
curl -fsSL https://solidaccounting.com/release-public.asc | gpg --import
# 2. Download the file and its .asc into the same folder
# 3. Verify
gpg --verify "Solid Accounting Desktop_26.9.6_amd64.AppImage.asc" "Solid Accounting Desktop_26.9.6_amd64.AppImage"Use the names of the files you downloaded; the version number changes with each release.
The line that matters is Good signature from "Solid Accounting Releases". Check that the key fingerprint GPG prints is:
04CE 2D86 415D AE96 2867 2401 36F0 B48A 8D18 F571
What the messages mean
"Can't check signature: No public key" — you haven't imported the release key yet. Run step 1.
"BAD signature" — don't run or install the file. It changed after we signed it, or it doesn't match its .asc. Download both files again from the same release, from a network that doesn't rewrite downloads. If it's still bad, email support@solidaccounting.com with the output of sha256sum on the file.
"This key is not certified with a trusted signature" — normal. The signature is valid; GPG is only saying you haven't marked the key as trusted. gpg --sign-key releases@solidaccounting.com silences it in your own keyring.
Checksum only
Without GPG, compare the file's SHA-256 with the one on the download page:
sha256sum "Solid Accounting Desktop_26.9.6_amd64.AppImage"The two values must match exactly. A checksum catches a damaged download, but not someone who replaced both the file and the checksum. The GPG signature does.