HPLIP has implemented a process so you (the user) can optionally verify that the package you are downloading is, indeed, provided by the HP Linux Imaging and Printing project and has valid contents. The process to verify the package is simple and takes only a few moments. The steps are provided in detail below.
At all of the steps where <version> occurs, replace it with the version of HPLIP you downloaded.
To verify the HPLIP automatic installer run file digital signature:
1. Download the HPLIP install file (hplip-<version>.run file) from https://developers.hp.com/hp-linux-imaging-and-printing/gethplip
2. Download the digital signature file (hplip-<version>.run.asc file) also from https://developers.hp.com/hp-linux-imaging-and-printing/gethplip
3. Get HPLIP's public key (run as a regular user):
For HPLIP Version 3.9.12 and above:
/usr/bin/gpg --keyserver pgp.mit.edu --recv-keys 0xA59047B9
For below HPLIP Version 3.9.12 :
/usr/bin/gpg --keyserver pgp.mit.edu --recv-keys 0x9013C005
4. Verify the HPLIP key to the HPLIP package (run as a regular user):
gpg --verify hplip-version.run.asc hplip-<version>.run
Replace <version> with the version you downloaded, e.g. 3.9.12
To verify the manual install (tarball) HPLIP package follow these steps:
1. Download the HPLIP install file (hplip-<version>.tar.gz file) from https://developers.hp.com/hp-linux-imaging-and-printing/gethplip
2. Download the digital signature file (hplip-<version>.tar.gz.asc file) also from https://developers.hp.com/hp-linux-imaging-and-printing/gethplip.
3. Get HPLIP's public key (run as a regular user):
For HPLIP Version 3.9.12 and above:
/usr/bin/gpg --keyserver pgp.mit.edu --recv-keys 0xA59047B9
For below HPLIP Version 3.9.12 :
/usr/bin/gpg --keyserver pgp.mit.edu --recv-keys 0x9013C005
4. Verify the HPLIP key to the HPLIP package (run as a regular user):
gpg --verify hplip-version.tar.gz.asc hplip-<version>.tar.gz
Replace <version> with the version you downloaded, e.g. 3.9.12