Does this file really come from Mantel?

Every download has its own GPG signature. With it you can check in a few minutes that the file wasn't modified on the way and was signed with the Mantel release key.

Mantel Release Signing

ed25519 · valid until 21 October 2028

Fingerprint

Download public keyGo to download

Android signing certificate (SHA-256)

Guide

  1. 1

    Install GnuPG

    Windows: Gpg4win from gpg4win.org (includes gpg for PowerShell and the command prompt). macOS: GPG Suite or Homebrew. Linux: gpg is usually preinstalled, otherwise use your package manager.

    gpg --version
brew install gnupg        # macOS
sudo apt install gnupg    # Debian/Ubuntu
  2. 2

    Import the key

    Download the public key mantel-release-key.asc (button above) and import it.

    gpg --import mantel-release-key.asc
  3. 3

    Compare the fingerprint

    Show the fingerprint and compare it block by block with the one above. If it doesn't match, stop here.

    gpg --fingerprint "Mantel Release Signing"
  4. 4

    Check the signature

    Put the file (Windows installer or Android APK) and its signature (.asc) in the same folder and check it there.

    gpg --verify Mantel-Setup-<version>-x64.exe.asc Mantel-Setup-<version>-x64.exe
gpg --verify Mantel-2026.0.2.apk.asc Mantel-2026.0.2.apk

Reading the result

gpg: Signature made …
gpg:                using EDDSA key 5F211CA226A2D3067503C77AA2D7CDF2674DE23E
gpg: Good signature from "Mantel Release Signing" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 5F21 1CA2 26A2 D306 7503  C77A A2D7 CDF2 674D E23E

  • “Good signature from "Mantel Release Signing"” means the file is unmodified, bit for bit, and was signed with the Mantel key.

  • The warning “This key is not certified with a trusted signature!” is expected. GnuPG just doesn't know that you trust the key. What matters is that the fingerprint matches the one on this page. To get rid of the warning, certify the key locally with gpg --lsign-key.

  • “BAD signature”, “No public key” or a different fingerprint: don't install the file, download it again and check again.

Checksums with SHA256SUMS

SHA256SUMS lists the SHA-256 checksums of all files in a release and is signed itself. Check the list's signature first, then your file's checksum.

Linux, macOS, Git Bash

gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missing
shasum -a 256 -c SHA256SUMS --ignore-missing   # macOS

Windows PowerShell (compare the result with the line in SHA256SUMS)

gpg --verify SHA256SUMS.asc SHA256SUMS
(Get-FileHash .\Mantel-Setup-<version>-x64.exe -Algorithm SHA256).Hash.ToLower()
Get-Content SHA256SUMS

Android APK

Android apps also carry their own signature, and Android only installs updates signed with the same certificate. apksigner from the Android SDK build tools shows its fingerprint. The line “Signer #1 certificate SHA-256 digest” must read:

apksigner verify --print-certs Mantel-2026.0.2.apk

The Windows installer doesn't have an Authenticode signature yet, so SmartScreen still warns. The GPG signature doesn't change that, but it proves the file comes from Mantel.