-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

To ensure the image has not been corrupted in transmit or tampered with,
perform the following two steps to cryptographically verify image integrity:

1. Verify the authenticity of this file by checking that it is signed with our
   GPG release key:

    $ curl https://raw.githubusercontent.com/turnkeylinux/common/master/keys/tkl-buster-images.asc | gpg --import
    $ gpg --list-keys --with-fingerprint release-buster-images@turnkeylinux.org
      pub   rsa4096 2020-02-05 [SC] [expires: 2040-01-31]
            A8B2 EF42 8781 9B03 D351  6CCA 7623 1C20 425E 9772
      uid           [ unknown] TurnKey GNU/Linux Buster Images (GPG signing key for TurnKey Linux Buster Images) <release-buster-images@turnkeylinux.org>
      sub   rsa4096 2020-02-05 [S] [expires: 2040-01-31]
      
    $ gpg --verify turnkey-tomcat-16.0-buster-amd64.iso.hash
      gpg: Signature made using RSA key ID A8B2EF4287819B03D3516CCA76231C20425E9772
      gpg: Good signature from "0"

2. Recalculate the image hash and make sure it matches your choice of hash below.

    $ sha256sum turnkey-tomcat-16.0-buster-amd64.iso
      4d3f3a288387d52c9d79767dda1c351e9cad9bb351b48d146e388413dac712c9  turnkey-tomcat-16.0-buster-amd64.iso

    $ sha512sum turnkey-tomcat-16.0-buster-amd64.iso
      18d83b3da6127ccfe53e9f250cdceb9c9426882e10a18ec19a59dc4da646c7dcb6b8c6419768766a7da18aec055f6263a347a6c342833659bcf9e0f6580661ed  turnkey-tomcat-16.0-buster-amd64.iso

   Note, you can compare hashes automatically::

    $ sha256sum -c turnkey-tomcat-16.0-buster-amd64.iso.hash
      turnkey-tomcat-16.0-buster-amd64.iso: OK

    $ sha512sum -c turnkey-tomcat-16.0-buster-amd64.iso.hash
      turnkey-tomcat-16.0-buster-amd64.iso: OK

    Final note, when checking SHAs automatically, please ignore warning noting that some lines are improperly formatted.

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE8ZCki1TcVrLH8k3LrF6wBJPlvBwFAl8Bl5kACgkQrF6wBJPl
vBwiCQ/7BtBml+duD7hsCAzDl320KjlNmj29vKzlacqopD3DtIAAAei6jQ2uOr5P
afdA/AinI5VUDgwn5B91K4o1kJbVRwYprxLGFRiT6dTa3IXqd0Juf/Y6A90ZHC3S
y4jQqYOt3cjzoRPE4/+gitQNQ2bPmLPKXQQkhno+woPTKiADbe0M4TqIXnV7yDwf
3lcKRad8Co2ijo8njsRVhkCF5fBliQtL59KYv1sMNOufPwtk43Isrm0104bUN3Pq
NRbyTYUGZ4ZGXSm6qF56xqgWd7mP5Xc/BvyJU//dszLs3lCpBKyBOnMm32kEQmQp
YjNcdH2yPgNG9Hx0OGzkSjMUkgRG7NODaNxdPj49Gxte1/SSc0Ib324fPRQtKkQx
6c3QtOXWZjty7gEJLEZ60jhYmPmVO1diYkSlE7LmLP605vMl5IIhVgEplyt0nFD8
QXOfcIC0UZPBhdq3HJDkar3p75KZLyUVpwBOk7rugZ5LTs1MNOum2QoP1cdZGb2v
wgU1EGMb6Uyo9dQnOmElKQo0IhXxqBSaXpGeLOVtvUNSBUP5SEMkWheDtdker+a3
61X+ZC3mbIiUZGBjnyMXTRA4NXQ3Ujj6+kfcMj937nvHZY1pTfBHw22hG696pwnd
B4evGM32IvAIs0AwlQ5TnILsWCXghhz9zuAOl6InnVog8hnICLU=
=JC24
-----END PGP SIGNATURE-----