How to Open a SIG File

What is a SIG file?

A .sig file is, commonly when supplied with a software download, an OpenPGP detached signature (defined in RFC 4880) — a small cryptographic proof, separate from the file it signs, that lets anyone confirm the file came from the claimed source and hasn't been modified since. It's the mechanism behind "verify this download" instructions on Linux distribution sites, GitHub release pages, and open-source project downloads generally.

Structurally, a signature file contains one or more OpenPGP Signature packets: a version number, the signature type (whether it signs a binary file or text), the public-key algorithm and hash algorithm used, a timestamp, and the signer's key ID or fingerprint — all of which are readable without needing any cryptographic key, which is exactly what this page's tool decodes. The actual proof of authenticity is a large number (the signature value itself) that can only be meaningfully checked against the original file and the signer's real public key, using dedicated software like GPG.

A .sig file comes in two forms: binary (compact, starts with a byte that has its high bit set) or ASCII-armored (starts with the text -----BEGIN PGP SIGNATURE-----, safe to paste into an email or web page). Both encode exactly the same underlying data — armor is just a base64-with-checksum text wrapper around the same binary packet.

How to verify a SIG file on Windows

1. Install Gpg4win (free, gpg4win.org), which includes GPG and a Windows-friendly interface.
2. Import the signer's public key: gpg --import theirkey.asc, or fetch it from a keyserver with gpg --recv-keys KEYID.
3. Open Command Prompt or PowerShell in the folder with both files, and run gpg --verify file.sig file (use the actual filenames).
4. Look for "Good signature" in the output — anything else means it failed to verify.

Verify a SIG file on Windows without the command line (Kleopatra)

Gpg4win installs Kleopatra, a graphical certificate manager, and registers it for .sig, .asc and .gpg files — so once it's installed, double-clicking a .sig file starts a verification instead of Windows asking "How do you want to open this file?".

1. Import the signer's key: in Kleopatra click Import and choose the key file the project provides (often KEYS, *.asc or *.pub), or use Lookup on Server and search for the key ID or email address.
2. Check the fingerprint: double-click the imported certificate and compare its fingerprint with the one printed on the project's official website. This is the step that actually protects you.
3. Verify: put the .sig next to the file it signs (same name minus .sig), then double-click the .sig — or use Decrypt/Verify in Kleopatra and select the .sig. Kleopatra finds the signed file automatically and shows a green result for a valid signature, or a red one if the file doesn't match.

Gpg4win also adds GpgEX to the File Explorer right-click menu (under Show more options on Windows 11) with a verify option. On a Mac, GPG Suite does the equivalent: its GPG Keychain app imports keys, and it adds an OpenPGP verify command to the Finder's right-click Services menu.

How to verify a SIG file on Mac

1. Install GPG via Homebrew (brew install gnupg) or the GPG Suite app.
2. Import the signer's public key the same way as on other platforms: gpg --import theirkey.asc.
3. Open Terminal in the folder with both files and run gpg --verify file.sig file.

How to verify a SIG file on Linux

1. GPG is pre-installed on almost every distribution; if not, install the gnupg package from your package manager.
2. Import the project's public key, often provided as a link on their download page: gpg --import key.asc, or gpg --recv-keys KEYID --keyserver keyserver.ubuntu.com.
3. Run gpg --verify file.sig file in the folder containing both files.

Common SIG file problems and how to fix them

"gpg: Can't check signature: No public key"

You haven't imported the signer's public key yet. Find it on the project's website, a keyserver, or the same download page as the signature, then import it before verifying.

"BAD signature" instead of "Good signature"

Take this seriously — it means the file doesn't match what was signed, whether from a corrupted download or genuine tampering. Re-download the file from the original source and verify again before trusting it.

GPG says the signature is good, but shows a warning about trust

This is normal and different from a bad signature: GPG is only saying it can't independently vouch for whether the key really belongs to who it claims, not that the file is wrong. The cryptographic match itself ("Good signature") is what confirms the file wasn't altered.

"gpg: no valid OpenPGP data found"

The file you're importing or verifying isn't OpenPGP data. Typically you saved a web page (HTML) instead of the raw key or signature — open it in a text editor; a key should start with -----BEGIN PGP PUBLIC KEY BLOCK-----. Use the "raw" or direct download link. It can also mean the .sig is a different signature type entirely (see other kinds of .sig files).

"gpg: no signed data" / "can't hash datafile: No data"

GPG found the signature but not the file it signs. Either name the data file explicitly (gpg --verify file.sig file) or make sure it sits in the same folder with exactly the same name minus .sig. Browsers that rename duplicates (file (1).iso) break the automatic match.

"gpg: keyserver receive failed: No data" (or "No keyserver available")

The keyserver doesn't have that key, or none is configured. Try another one explicitly — gpg --keyserver hkps://keys.openpgp.org --recv-keys KEYID or hkps://keyserver.ubuntu.com — or, better, download the key from the project's own website. For email-based keys, gpg --locate-keys dev@project.example can fetch them from the domain directly (WKD).

"Good signature" but from a key that expired or was revoked

GPG prints extra warnings such as "Note: This key has expired!" or "This key has been revoked by its owner!". An expired key on an old, unchanged release is usually fine; a revoked key means the owner no longer vouches for it — check the project's site for a newer signature before trusting the file.

Signatures vs checksums: SHA256SUMS, .sha256 and .sig

Many download pages offer both a checksum and a signature. They do different jobs:

• A checksum (SHA256SUMS, file.iso.sha256) only proves the file wasn't corrupted in transit — anyone who can swap the download can swap the checksum next to it.
• A signature proves who published it. Projects such as Ubuntu sign the checksum list itself (SHA256SUMS + SHA256SUMS.gpg), so you verify the signature once and then check the hash.

1. Verify the signed checksum list: gpg --verify SHA256SUMS.gpg SHA256SUMS → look for "Good signature".
2. Then check the file against it: Linux sha256sum -c SHA256SUMS --ignore-missing (prints OK next to the file); Mac shasum -a 256 file.iso; Windows PowerShell Get-FileHash .\file.iso -Algorithm SHA256 or Command Prompt certutil -hashfile file.iso SHA256 — and compare the result with the line in SHA256SUMS.

This is how you'd confirm a large ISO image or a ZIP release is genuine before installing from it.

Other kinds of .sig files (and signature.asc in emails)

"Signature" means different things to different programs, so not every .sig is an OpenPGP signature. Open the file in a text editor (it's safe — signatures contain no code) and look at how it starts:

• -----BEGIN PGP SIGNATURE----- → ASCII-armored OpenPGP signature. Use: GPG / Kleopatra / the tool above.
• Unreadable binary from the first byte → Usually a binary OpenPGP signature (e.g. Arch Linux .pkg.tar.zst.sig, many GNU .tar.gz.sig files). Use: GPG / the tool above.
• untrusted comment: … on the first line → An OpenBSD signify or minisign signature. Use: signify -V or minisign -V with the project's public key — not GPG.
• One line of base64 often starting ME… → A raw ECDSA signature, as produced by Sigstore's cosign sign-blob. Use: cosign verify-blob with the key or certificate the project names.
• Your name, job title, phone number → An email signature text file saved by a mail or newsreader program (the classic Unix ~/.signature idea). Use: Any text editor; paste it into your current mail app's signature settings.

What is the signature.asc attachment in an email?

If someone sends you a PGP-signed email, many mail apps show a small attachment called signature.asc (often around 1 KB). It's the OpenPGP signature of the message body, in the PGP/MIME format. It isn't a virus and there's nothing to "open": a PGP-aware client (Thunderbird has OpenPGP built in) checks it automatically and shows a signed-message indicator. Gmail, Outlook and phone mail apps don't verify PGP, so they just display it as an attachment you can ignore. The similar smime.p7s attachment is the same idea using S/MIME certificates; Outlook and Apple Mail verify those natively.

.sig vs .asc

Both extensions can hold the same OpenPGP signature. Convention is .sig for binary signatures (made with gpg --detach-sign) and .asc for ASCII-armored ones (gpg --armor --detach-sign), but many projects use .sig for armored files too. GPG reads either format regardless of the extension.

Related file extensions

Technical references

When a .sig file is an OpenPGP signature, its structure is defined by the IETF's OpenPGP standard — currently RFC 9580, which superseded the older RFC 4880 in 2024.

• RFC 9580 — OpenPGP — The current IETF standard defining the OpenPGP message and signature format (supersedes RFC 4880).

Frequently asked questions