-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

To ensure the image has not been corrupted in transmit or tampered with,
perform the following two steps to cryptographically verify image integrity:

1. Verify the authenticity of this file by checking that it is signed with our
   GPG release key:

    $ curl https://raw.githubusercontent.com/turnkeylinux/common/master/keys/tkl-buster-images.asc | gpg --import
    $ gpg --list-keys --with-fingerprint release-buster-images@turnkeylinux.org
      pub   rsa4096 2020-02-05 [SC] [expires: 2040-01-31]
            A8B2 EF42 8781 9B03 D351  6CCA 7623 1C20 425E 9772
      uid           [ unknown] TurnKey GNU/Linux Buster Images (GPG signing key for TurnKey Linux Buster Images) <release-buster-images@turnkeylinux.org>
      sub   rsa4096 2020-02-05 [S] [expires: 2040-01-31]
      
    $ gpg --verify turnkey-tracks-16.1-buster-amd64.iso.hash
      gpg: Signature made using RSA key ID A8B2EF4287819B03D3516CCA76231C20425E9772
      gpg: Good signature from "0"

2. Recalculate the image hash and make sure it matches your choice of hash below.

    $ sha256sum turnkey-tracks-16.1-buster-amd64.iso
      e42a2cd20181d24120aa906786214b73c56fec1c1fa4d3dfc58ec31820066ed7  turnkey-tracks-16.1-buster-amd64.iso

    $ sha512sum turnkey-tracks-16.1-buster-amd64.iso
      5a4391e6c67571e61ca5c19ccf1300043fffab3182e24b89fad248a54db3a1685558027d33a56172969378d2f7f896f9633feb5b34a1341e84b4333a5a054357  turnkey-tracks-16.1-buster-amd64.iso

   Note, you can compare hashes automatically::

    $ sha256sum -c turnkey-tracks-16.1-buster-amd64.iso.hash
      turnkey-tracks-16.1-buster-amd64.iso: OK

    $ sha512sum -c turnkey-tracks-16.1-buster-amd64.iso.hash
      turnkey-tracks-16.1-buster-amd64.iso: OK

    Final note, when checking SHAs automatically, please ignore warning noting that some lines are improperly formatted.

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE8ZCki1TcVrLH8k3LrF6wBJPlvBwFAmBh2OIACgkQrF6wBJPl
vBw5EBAAo5qZmmYyg1MP9rO/0zyJfJmg3aSaqztZdadGjgO3oPglxCoP/6h299eg
MkYG6KQJZMFS881c/w72Rra/QCo++YXGD9PLyu2rPz/yhqjRTkUuh6rMSnESNX5b
W8sh8VZGQqAtEG74vpcJL2mT1uoOshW3Org0bWeI00eYQSkZFb34vpsWldR1BlBJ
kqRdxIWbfx21nqBNdHH0nuwZjZ80/I+lo5XyyKyeZMmpEe3fe1LWIrQv+5E3OXlC
NiLpe4SiOPl8sVzJW85q/mBQRE20JJo19ozY0eK+tB7HQeLItEuVwk/Y/ivsG09F
2QbRRMV05lqG4DYOD2r90af3ZcGSZQnIsGQJRB1tBRm5MYI1ZxwjNpwZR64q2c3I
Lshvn2h5qsZz5jjEILQmBaVqIqKDFL0n1m556hRQ1J3iekq7tUV1V5VthIh96az3
9YMQ90d/LNYkRpCCmzBC8c949Sn0pubFameGmT/5Xzt9Bj3k5BWmiBqGf389NHQt
mvs1GVcVf2LyAvykhaBcOprNlSbYkiKf5fkBQh/QzMyLjrpE2jTHAs1OcyGqM6YN
mziSQrxwyS4zDxCuk4/pMV9RXVm20NcdcYHfcI9hMdsU4BUm/BTk5ab47hQDMEY5
KjE7sEC7aHpei673aSgdg72fAv3eso6rVc6dRzJU4lVxOO8pT7A=
=pCvw
-----END PGP SIGNATURE-----