-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 To ensure the image has not been corrupted in transmit or tampered with, perform the following two steps to cryptographically verify image integrity: 1. Verify the authenticity of this file by checking that it is signed with our GPG release key: $ curl https://raw.githubusercontent.com/turnkeylinux/common/master/keys/tkl-buster-images.asc | gpg --import $ gpg --list-keys --with-fingerprint release-buster-images@turnkeylinux.org pub rsa4096 2020-02-05 [SC] [expires: 2040-01-31] A8B2 EF42 8781 9B03 D351 6CCA 7623 1C20 425E 9772 uid [ unknown] TurnKey GNU/Linux Buster Images (GPG signing key for TurnKey Linux Buster Images) sub rsa4096 2020-02-05 [S] [expires: 2040-01-31] $ gpg --verify debian-10-turnkey-dokuwiki_16.1-1_amd64.tar.gz.hash gpg: Signature made using RSA key ID A8B2EF4287819B03D3516CCA76231C20425E9772 gpg: Good signature from "0" 2. Recalculate the image hash and make sure it matches your choice of hash below. $ sha256sum debian-10-turnkey-dokuwiki_16.1-1_amd64.tar.gz 9ad9bf37e6eda87ae9369343e29e2a1bb071a6df6e1d31660f1238162dcf541d debian-10-turnkey-dokuwiki_16.1-1_amd64.tar.gz $ sha512sum debian-10-turnkey-dokuwiki_16.1-1_amd64.tar.gz 9014abc68ccd30db3a2d8e74d86b0e801ff24deb20e72b390219b30fd347a0cb3070ae9e8a4168ca447eab5840ee6f62cd136919e702e0ac25e6619b2130ffdc debian-10-turnkey-dokuwiki_16.1-1_amd64.tar.gz Note, you can compare hashes automatically:: $ sha256sum -c debian-10-turnkey-dokuwiki_16.1-1_amd64.tar.gz.hash debian-10-turnkey-dokuwiki_16.1-1_amd64.tar.gz: OK $ sha512sum -c debian-10-turnkey-dokuwiki_16.1-1_amd64.tar.gz.hash debian-10-turnkey-dokuwiki_16.1-1_amd64.tar.gz: OK Final note, when checking SHAs automatically, please ignore warning noting that some lines are improperly formatted. -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE8ZCki1TcVrLH8k3LrF6wBJPlvBwFAmA7b44ACgkQrF6wBJPl vBwlsRAAkruehvWnQc41vI07zTA6qCTvKErmeSwLTR4MwKfFG0sTCV8gDIjOu/0L eeEe0l0AJBu+NX6HVzCQY16sBYNuC9Y5J+pnCIWLg+mmwmaNEv4tk9YbdNpTSA0y UIJHqMoDv8Td2JPxQPTBxb5InzXzmYkLrkC+sPlrGUK/EnEOtav9oxlnDQawl67Y CqRKenObpCBZMICgt6cmTY3KLMIfVOW/WBTjdQGwzJpjzmQkCEQpiaJjnDqTgW01 IGExgTlKml7Em26SwxmIoNhN47/hPDiw3EYZ/1fEkYdsU1FYQ1mdkvJGEpfL4Mho sicVlhdcO5AW/SWB8e8hoSnXX3BjXhEx+acI15WP8YPEfK6OS8KjDdKbYgx7iq2K XTYHCqzQVEM6Towh29IgOIJ3HhCBGXkJFELQSF3NtOdLq/zjr1EKkvBcwnbgPuOB CBZlfnq6AGJsOIznoJzuK0i0Wp4AoWgOicGZnIstA8VE/6fcBiKO4n4uDnhnwn93 qYEdHC4ehkPEgEh+nOMwSVE3vBHckR+2mysGh+sewDvf+dHk8kkPgnR4I9jpBGaX NPDzwFTUq46Ls7FXHkSQTRkF9XqXrQVmwX+itNHuvIXskn0Y6otaGuODXWkIdcfN y94qBQPT3kLXQTyxyNP7AzgyA2CEO7PAD3aSTVXQHCmzX0UC6ow= =9C/R -----END PGP SIGNATURE-----