```bash
gpg --keyserver hkps://keys.openpgp.org --recv-keys 1BD97A6A154E7810EE0BC832E2F38302C8075E3D
```

### Verifying signatures

Once you've downloaded a Gradle JAR file or a distribution and its corresponding signature file (with a `.asc` extension), you can verify its authenticity against the public key.

And your users would be able to login from your Django app or from your **FastAPI** app, at the same time.

///

## Hash and verify the passwords { #hash-and-verify-the-passwords }

Import the tools we need from `pwdlib`.

Create a PasswordHash instance with recommended settings - it will be used for hashing and verifying passwords.

/// tip

You can try it already in the interactive docs:

<img src="/img/tutorial/security/image03.png">

We are not verifying the validity of the token yet, but that's a start already.

## Recap { #recap }

            // Verify with second digest (simulating server verification)
            boolean isValid = digest2.verify(data, 0, data.length, 0, response);

            assertTrue(isValid, "Valid signature should verify correctly");
        }

        @Test
        @DisplayName("Should sign and verify round trip for SMB 2.1")

        UpgradeContext context = createMockContext();

        help.execute(context);

        // Verify that logger.info was called multiple times
        // We can't easily verify the exact content without capturing the logger output,
        // but we can verify that the method executes without errors
        Mockito.verify(context.logger, Mockito.atLeastOnce()).info(Mockito.anyString());
    }

    @Test

        verifier.verify(logger, calls(1)).debug("Importing foreign packages into class realm {}", "maven.api");
        verifier.verify(logger, calls(1)).debug("  Imported: {} < {}", "group1:artifact1", "test");
        verifier.verify(logger, calls(1)).debug("  Excluded: {}", "group1:artifact2:ext:classifier1:null");
        verifier.verify(logger, calls(1))

        // Add an include - this should work now
        resource.addInclude("test");

        // Verify the include was added
        assertEquals(1, resource.getIncludes().size(), "Should have one include");
        assertEquals("test", resource.getIncludes().get(0), "Include should be 'test'");

        // Verify that getting resources again still shows the include
        List<Resource> resourcesAfter = project.getResources();

    ExecutorService service = mock(ExecutorService.class);
    application.addDelayedShutdownHook(service, 2, SECONDS);
    verify(service, Mockito.never()).shutdown();
    application.shutdown();
    InOrder shutdownFirst = Mockito.inOrder(service);
    shutdownFirst.verify(service).shutdown();
    shutdownFirst.verify(service).awaitTermination(2, SECONDS);
  }

        // Execute - should not throw any exception
        processor.process(responseData);

        // Verify child URLs are unchanged
        assertEquals(2, responseData.getChildUrlSet().size());
    }

    public void test_noOpBehavior() {
        // Verify that NullResponseProcessor truly does nothing
        NullResponseProcessor processor = new NullResponseProcessor();

            assertTrue(result.success(), "Orchestrator should succeed");

            // Verify only applicable strategy was executed
            verify(mockStrategies.get(0)).apply(Mockito.eq(context), Mockito.any());
            verify(mockStrategies.get(1), Mockito.never()).apply(Mockito.any(), Mockito.any());
            verify(mockStrategies.get(2), Mockito.never()).apply(Mockito.any(), Mockito.any());
        }

        @Test