Welcome to GnuPG 2.2
Installation Instructions
Double click the Install package to install GnuPG 2.2. Any previous version of GnuPG 2.2 will automatically be uninstalled during the installation process. Do not install GnuPG to any target other than your “Macintosh HD” device.
Converting existing Keyrings
If you do not intend to use your keyring with GnuPG 1.x or 2.0.x in the future, we recommend that you convert your keyring to the new GnuPG 2.2 format. This will speed up any keyring operations. However, the drawback is that your keyring is not compatible to GnuPG versions before 2.2.
To convert an existing pubring.gpg file to the new keybox format, a helper tool is provided. Simply execute
/usr/local/gnupg-2.2/bin/convert-keyring
Verifying the Download Integrity
The SHA-256 sum of the downloaded file (e.g. GnuPG-2.2.0.dmg) can be verified as follows.
1. Open a Terminal window
2. Execute: shasum -a 256 Downloads/GnuPG-2.2.0.dmg
4. Compare the checksum you got in the Terminal with the SHA-256 sum on the web page.
Verifying the Package Signature
In addition to the developer signature verified by Mac OS X, the Installer Disk Image also contains an OpenPGP signature which can be used to verify the Installer package. To verify the integrity of the installer, download the package signature file (e.g. GnuPG-2.2.0.dmg.sig), then open a Terminal window and execute:
gpg2 --keyserver pool.sks-keyservers.net --recv-keys 0xDB1187B9DD5F693B
gpg2 --verify GnuPG-2.2.0.dmg.sig GnuPG-2.2.0.dmg
The 1st command will download and import the public key that you need in order to verify the signature; the second command verifies the signature.
License
GnuPG and all its parts, are licensed under the GNU Public License and/or the Lesser GNU Public License. See License.txt for details.
Source Code
The GnuPG source code is available from https://www.gnupg.org/download/index.html
The tools and patches used to create this installer are available from https://sourceforge.net/p/gpgosx/