See Release Notes for changes The source code .sig files have been signed by Stefan Rueger and can be verified with the OpenPGP public key 45684AB70D286F63. For example, gpg --keyserver keys.openpgp.org --recv-keys 45684AB70D286F63 will ingress the public signing key into your keyring and gpg --verify avrdude-8.2.tar.gz.sig avrdude-8.2.tar.gz verifies the hash of the source tar ball.