Verifying signatures - 指南

To verify the Mullvad Browser, visit the following guide: https://mullvad.net/help/verifying-mullvad-browser-signature/

Learn how to verify the Mullvad VPN app releases.

Install GnuPG

First you need to get GnuPG (GPG) version 2.1 or newer. Avoid the legacy 1.4 version of GnuPG.

Linux

Many Linux distros come with GnuPG already installed. If not, you can usually install it via the default package manager under the package name gnupg2.

macOS

Install GnuPG 2.2 via Homebrew by running brew install gnupg in the Terminal app.

Windows

You can install the Gpg4win package available on the official GnuPG website. After doing that, the gpg command should be available in the Command Prompt.

Download and import the signing key

The fingerprint of our code signing key is A1198702FC3E0A09A9AE5B75D5A1D4F266DE8DDF and it can be downloaded from our website or by using wget in a Linux Terminal:

wget https://mullvad.net/media/mullvad-code-signing.asc

Then import the key using the following command in the Terminal (Linux, macOS) or Command Prompt (Windows) in the folder where the key was downloaded:

gpg --import mullvad-code-signing.asc

Trust the signing key

Once you have downloaded the signing key you should set the trust level to "ultimate" so that it can be used to automatically verify all the keys signed by the Mullvad signing key. This step can be skipped, but then a warning will be printed during each file verification saying that the key is not certified with a trusted signature.

To open the GnuPG key edit prompt, enter the following command:

gpg --edit-key A1198702FC3E0A09A9AE5B75D5A1D4F266DE8DDF

You should get this output:

gpg (GnuPG) 2.1.13; Copyright (C) 2016 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

pub  rsa4096/D5A1D4F266DE8DDF
     created: 2016-10-27  expires: never       usage: SC 
     trust: unknown       validity: unknown
sub  rsa4096/C187D22C089EF64E
     created: 2016-10-27  expires: never       usage: E  
sub  rsa4096/A26581F219C8314C
     created: 2016-10-27  expires: never       usage: S  
[ unknown] (1). Mullvad (code signing) <admin@mullvad.net>

Configure the key trust

At the gpg> prompt enter the following command:

trust

You should get this output:

pub  rsa4096/D5A1D4F266DE8DDF
     created: 2016-10-27  expires: never       usage: SC
     trust: unknown       validity: unknown
sub  rsa4096/C187D22C089EF64E
     created: 2016-10-27  expires: never       usage: E 
sub  rsa4096/A26581F219C8314C
     created: 2016-10-27  expires: never       usage: S 
[ unknown] (1). Mullvad (code signing) <admin@mullvad.net>

Please decide how far you trust this user to correctly verify other users' keys
(by looking at passports, checking fingerprints from different sources, etc.)

  1 = I don't know or won't say
  2 = I do NOT trust
  3 = I trust marginally
  4 = I trust fully
  5 = I trust ultimately
  m = back to the main menu

Set trust level

When it asks "Your decision?", type 5 and press Enter.

When it asks "Do you really want to set this key to ultimate trust?", type y and press Enter.

Your decision? 5
Do you really want to set this key to ultimate trust? (y/N) y

You should get this output:

pub  rsa4096/D5A1D4F266DE8DDF      created: 2016-10-27  expires: never       usage: SC
     trust: ultimate      validity: unknown
sub  rsa4096/C187D22C089EF64E
     created: 2016-10-27  expires: never       usage: E 
sub  rsa4096/A26581F219C8314C
     created: 2016-10-27  expires: never       usage: S 
[ unknown] (1). Mullvad (code signing) <admin@mullvad.net>
Please note that the shown key validity is not necessarily correct
unless you restart the program.

Quit

At the gpg> prompt type q and press Enter.

Verify the Mullvad VPN app

To verify the installer of the Mullvad VPN app you need the signature file. The signature file is a file with the exact same filename as the installer, but with .asc appended at the end. Download the signature file for the Mullvad VPN app release you wish to verify, they are found under Download Client, and then click on the relevant signature file. The signature file must be placed in the same directory as the installer for this to work.

In this example, we will download the latest Mullvad VPN app for Debian and it's signature in a terminal.

wget --trust-server-names https://mullvad.net/download/app/deb/latest
wget --trust-server-names https://mullvad.net/download/app/deb/latest/signature

Do the actual verification

The following command will try to verify all signature files starting with "MullvadVPN-" and with the file extension ".asc". But please replace this wildcard name with the actual full name of your signature file if you want to.

gpg --verify MullvadVPN-*.deb.asc

If you have multiple .asc files in the same folder then use the full filename or the verification may fail.

You should get this output:

gpg: assuming signed data in 'MullvadVPN-2019.4_x86_64.rpm'
gpg: Signature made Tue Jun 11 22:14:58 2019 CEST
gpg:                using RSA key CA83A46153BC58D69518ED49A26581F219C8314C
gpg: checking the trustdb
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: Good signature from "Mullvad (code signing) <admin@mullvad.net>" [ultimate]

The important part above is that the output starts with

assuming signed data in '{Filename of installer you want to verify}'

and ends with

Good signature from "Mullvad (code signing) <admin@mullvad.net>".

Code signing key

Here is the code signing key in plain text: