HPLIP has implemented a process so by which you (the user) can optionally verify that the package you are downloading is indeed provided by the HP Linux Imaging and Printing project and has valid contents.  The process to verify the package is simple and takes only a few moments.  The steps are provided in detail below.

At all of the steps where <version> replace with the version of HPLIP you have downloaded.

To verify the HPLIP automatic installer run file digital signature:

1. Download the HPLIP install file (hplip-<version>.run file) from http://hplipopensource.com

2. Download the digital signature file (hplip-<version>.run.asc file) also from http://hplipopensource.com.

3. Get HPLIP's public key (run as a regular user):

     For HPLIP Version 3.9.12 and above:

  /usr/bin/gpg --keyserver pgp.mit.edu --recv-keys 0xA59047B9

     For below HPLIP Version 3.9.12 :

  /usr/bin/gpg --keyserver pgp.mit.edu --recv-keys 0x9013C005

4. Verify the HPLIP key to the HPLIP package (run as a regular user):

  gpg --verify hplip-version.run.asc hplip-<version>.run

Replace <version> with the version you downloaded, e.g. 3.9.12

To verify the manual install (tarball) HPLIP package follow these steps:

1. Download the HPLIP install file (hplip-<version>.tar.gz file) from http://hplipopensource.com

2. Download the digital signature file (hplip-<version>.tar.gz.asc file) also from http://hplipopensource.com.

3. Get HPLIP's public key (run as a regular user):

     For HPLIP Version 3.9.12 and above:

  /usr/bin/gpg --keyserver pgp.mit.edu --recv-keys 0xA59047B9

     For below HPLIP Version 3.9.12 :

  /usr/bin/gpg --keyserver pgp.mit.edu --recv-keys 0x9013C005

4. Verify the HPLIP key to the HPLIP package (run as a regular user):

  gpg --verify hplip-version.tar.gz.asc hplip-<version>.tar.gz

Replace <version> with the version you downloaded, e.g. 3.9.12