Mailing List Archive

GnuPG 1.4.18 released

We are pleased to announce the availability of a new stable GnuPG-1
release: Version 1.4.18. This release fixes a regression introduced
with the 1.4.17 release.

The GNU Privacy Guard (GnuPG) is GNU's tool for secure communication and
data storage. It is a complete and free replacement of PGP and can be
used to encrypt data and to create digital signatures. It includes an
advanced key management facility, smartcard support and is compliant
with the OpenPGP Internet standard as described by RFC-4880. GnuPG is
distributed under the terms of the GNU General Public License (GPLv3+).

Note that this version is from the GnuPG-1 series and thus smaller than
those from the GnuPG-2 series, easier to build, and also better portable
to ancient platforms. In contrast to GnuPG-2 (e.g version 2.0.23) it
comes with no support for S/MIME, Secure Shell, or other tools useful
for desktop environments. Fortunately you may install both versions
alongside on the same system without any conflict.

What's New

* Fix a regression in 1.4.17 if more than one keyid is given
to --recv-keys et al.

* Cap RSA and Elgamal keysize at 4096 bit also for unattended key

Getting the Software

First of all, decide whether you really need GnuPG version 1.4.x - most
users are better off with the modern GnuPG 2.0.x version. Then follow
the instructions found at or read on:

GnuPG 1.4.18 may be downloaded from one of the GnuPG mirror sites or
direct from . The list of mirrors can be
found at . Note, that GnuPG is not
available at

On and on its mirrors you should find the following new
files in the *gnupg* directory:

- The GnuPG source code compressed using BZIP2 and its OpenPGP

gnupg-1.4.18.tar.bz2 (3564k)

- The GnuPG source code compressed using GZIP and its OpenPGP

gnupg-1.4.18.tar.gz (4930k)

- A patch file to upgrade a 1.4.16 GnuPG source tree. This patch does
not include updates of the language files.

gnupg-1.4.17-1.4.18.diff.bz2 (5k)

Select one of them. To shorten the download time, you probably want to
get the BZIP2 compressed file. Please try another mirror if exceptional
your mirror is not yet up to date.

In the *binary* directory, you should find these files:

- GnuPG compiled for Microsoft Windows and its OpenPGP signature.
This is a command line only version; the source files are the same
as above.

gnupg-w32cli-1.4.18.exe (1575k)

Note, that this is a minimal installer and unless you are only in need
for the simple the gpg binary, you are better off using the full
featured installer at .

Checking the Integrity

In order to check that the version of GnuPG which you are going to
install is an original and unmodified one, you can do it in one of
the following ways:

* If you already have a trusted version of GnuPG installed, you
can simply check the supplied signature. For example to check the
signature of the file gnupg-1.4.18.tar.bz2 you would use this command:

gpg --verify gnupg-1.4.18.tar.bz2.sig

This checks whether the signature file matches the source file.
You should see a message indicating that the signature is good and
made by that signing key. Make sure that you have the right key,
either by checking the fingerprint of that key with other sources
or by checking that the key has been signed by a trustworthy other
key. Note, that you can retrieve the signing key using the command

finger wk ,at' | gpg --import

or using a keyserver like

gpg --recv-key 4F25E3B6

The distribution key 4F25E3B6 is signed by the well known key
1E42B367. If you get an key expired message, you should retrieve a
fresh copy as the expiration date might have been prolonged.


* If you are not able to use an old version of GnuPG, you have to verify
the SHA-1 checksum. Assuming you downloaded the file
gnupg-1.4.18.tar.bz2, you would run the sha1sum command like this:

sha1sum gnupg-1.4.18.tar.bz2

and check that the output matches the first line from the
following list:

41462d1a97f91abc16a0031b5deadc3095ce88ae gnupg-1.4.18.tar.bz2
ea7d66c3de7aaf46de9e8678f4fc4a8c329400b2 gnupg-1.4.18.tar.gz
f30571f855b3ff8becff5378a884638da4c3cc9e gnupg-1.4.17-1.4.18.diff.bz2
579de2464528b436f39c5835e766867a1efa5fee gnupg-w32cli-1.4.18.exe


GnuPG comes with support for 29 languages. The Chinese (Simple and
Traditional), Czech, Danish, Dutch, French, German, Norwegian, Polish,
Romanian, Russian, Spanish, Swedish, Ukrainian, and Turkish translations
are close to be complete.


Please consult the archive of the gnupg-users mailing list before
reporting a bug <>.
We suggest to send bug reports for a new release to this list in favor
of filing a bug at <>. We also have a dedicated
service directory at <>.

The driving force behind the development of GnuPG is the company of
its principal author, Werner Koch. Maintenance and improvement of
GnuPG and related software takes up most of their resources. To allow
him to continue this work he kindly asks to either purchase a support
contract, engage g10 Code for custom enhancements, or to donate money:


We have to thank all the people who helped with this release, be it
testing, coding, translating, suggesting, auditing, donating money,
spreading the word, or answering questions on the mailing lists.
Jean-René Reinhard, Olivier Levillain, and Florian Maury of
found and reported the compression bug we fixed in 2.0.24. Jean-René
should have been mentioned in the original commit message.



Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.