deleted by creator

Depends on the context, I think. For me, I rarely do it for personal stuff. If I wanted to be perfect, I could do it, assuming a signature is available to verify, but I’m lazy. I would venture to say most folks don’t do it either.

With that being said, where I have been consistent about doing it has been writing config management code at work. If I need to have it download an installer from an untrusted source, I can verify that I’m installing the same package on all servers by verifying the signature before installation. This doesn’t always work well in all circumstances, though.

What are you trying to do? If this is SAML or some sort of signed auth, yeah it’s kinda really important to verify that. If it’s data that you’re ingesting, yeah you probably want to know who it came from. Otherwise anybody can send you junk data and overwrite your customer data (or whatever you’re importing). If it’s some binary blob you’re running, yeah you should probably verify that signature is signed by somebody you trust.

EDIT: thanks to all who replied. Maybe I should have written “what’s the easiest way to verify an apk file on an android phone?” Unfortunately, I guess I’m not smart enough to understand your answers 🙁

If you get the sha256 from the same place you got the main file, then anyone tampering with the main file could also recalculate the sha256 to match the tampered file. A signature signed with a certificate uses complex math (public-key asymmetric cryptography) to give some certainty that the signed content (the sha256) is the same sha256 that the original file author created. It’s not mathematically feasible to recalculate the certificate signature. Why don’t we just sign the whole original file with the public-key crypto and skip the sha256? Because asymmetric crypto is much, much slower than plain symmetric crypto or hash functions. It’s faster and easier to generate the valid hash or key, then sign or encrypt just the smaller key.