Verify your VASP download

Every VASP release on the download portal is published together with a signed checksums file, so you can confirm that the files you downloaded are both authentic (genuinely from VASP Software GmbH) and intact (not corrupted or altered in transit). We recommend verifying every download, especially before installing on shared or HPC systems.

For each release you will find three items on the portal:

• the release archive(s), e.g. `vasp.<version>.tgz`
• `SHA256SUMS_<version>` — the SHA-256 checksums of the release files
• `SHA256SUMS_<version>.asc` — our detached GPG signature of the `SHA256SUMS` file

You need [1] installed (`gpg`), which is already available on most Linux and HPC systems.

1. 1. One-time setup: import and verify our signing key

Download our public signing key. (**<PASTE THE URL WHERE YOU HOST vasp-release-pubkey.asc>**) and import it:

``` gpg --import vasp-release-pubkey.asc ```

Then confirm the key's fingerprint:

``` gpg --fingerprint "VASP Software GmbH (release signing)" ```

The fingerprint shown **must exactly match** the one published on our website:

``` <PASTE YOUR 40-CHARACTER KEY FINGERPRINT HERE> ```

Comparing the fingerprint against the value on our website — through a channel independent of the download portal — is what protects you against a substituted key. You only need to do this once.

1. 1. For each download: verify the signature, then the checksums

Run both commands in the directory containing the downloaded files.

• • 1. Confirm the checksums file is authentic:**

``` gpg --verify SHA256SUMS.asc SHA256SUMS ```

Look for a line reading `Good signature from "VASP Software GmbH ..."`.

• • 2. Confirm your downloaded files match the checksums:**

``` sha256sum -c SHA256SUMS ```

(On macOS, use `shasum -a 256 -c SHA256SUMS` instead.)

Each file should report `OK`.

1. 1. Interpreting the result

| What you see | Meaning | |---|---| | `Good signature` **and** every file reports `OK` | The download is authentic and intact. Proceed with installation. | | `gpg: WARNING: This key is not certified with a trusted signature!` | **Normal, not an error.** It appears whenever a key has not been marked as trusted on your machine. As long as you verified the fingerprint above, the signature is valid. | | `BAD signature`, or any file reports `FAILED` | **Do not use the files.** Re-download the release. If the problem persists, contact us at **<PASTE YOUR SUPPORT EMAIL>**. | | `Can't check signature: No public key` | You have not imported our signing key. Return to the one-time setup step above. |

If you have any doubt about the integrity of a download, stop and contact us at

• • <PASTE YOUR SUPPORT EMAIL>** before installing.