Verifying the Proton Mail desktop app package on Fedora (RPM)

Proton signs the Proton Mail desktop app RPM package, starting with version 1.16.0. Before installing, check that the package really comes from Proton and hasn’t been tampered with. You only need to set this up once. Without this check, dnf installs the package even if the signature can’t be verified, and on Fedora 45 or later rpm refuses to install it.

How to verify the RPM package

1. Open a terminal in the folder where you want to download the files.

wget https://proton.me/download/mail/linux/RPM-GPG-KEY
proton-mail
wget https://proton.me/download/mail/linux/ProtonMail
desktop-beta.rpm

2. Optional: check the key’s fingerprint (a unique ID that confirms it’s Proton’s key):

gpg --show-keys RPM-GPG-KEY-proton-mail

The line right under pub should show this fingerprint:

1C27DF7A717BCBCAC760A84C0DB4B0701E5FB04A

If it doesn’t match, stop and contact Proton support.

3. Import the key:

sudo rpm --import RPM-GPG-KEY-proton-mail

4. Check the app package:

rpm --checksig ProtonMail-desktop-beta.rpm

The output should end with digests signatures OK.

5. Install the app:

sudo dnf install ./ProtonMail-desktop-beta.rpm

dnf may print skipped OpenPGP checks for 1 package from repository: @commandline. That’s expected, because you already checked the package in step 4.

Troubleshooting

SIGNATURES NOT OK, or a NOKEY error or warning: Either the key isn’t imported (repeat steps 1–3), or the package is older than version 1.16.0 and isn’t signed.

The check fails after Proton announces a key update: Import the key again (steps 1–3). If rpm --version shows a version older than 6, remove the old key first:

1. List the installed keys:

rpm -q gpg-pubkey --qf '%{NAME}-%{VERSION}-%{RELEASE}\t%  
{SUMMARY}\n'

2. Remove the Proton AG (Proton Mail Desktop) entry, using the name from the list:

sudo rpm -e gpg-pubkey-xxxxxxxx-xxxxxxxx