-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 To ensure the image has not been corrupted in transmit or tampered with, perform the following two steps to cryptographically verify image integrity: 1. Verify the authenticity of this file by checking that it is signed with our GPG release key: $ curl https://raw.githubusercontent.com/turnkeylinux/common/master/keys/tkl-buster-images.asc | gpg --import $ gpg --list-keys --with-fingerprint release-buster-images@turnkeylinux.org pub rsa4096 2020-02-05 [SC] [expires: 2040-01-31] A8B2 EF42 8781 9B03 D351 6CCA 7623 1C20 425E 9772 uid [ unknown] TurnKey GNU/Linux Buster Images (GPG signing key for TurnKey Linux Buster Images) sub rsa4096 2020-02-05 [S] [expires: 2040-01-31] $ gpg --verify debian-10-turnkey-etherpad_16.1-1_amd64.tar.gz.hash gpg: Signature made using RSA key ID A8B2EF4287819B03D3516CCA76231C20425E9772 gpg: Good signature from "0" 2. Recalculate the image hash and make sure it matches your choice of hash below. $ sha256sum debian-10-turnkey-etherpad_16.1-1_amd64.tar.gz 825b31c091b3d58ae84d1a0b710f44fd1a28d6f97c8ddac429275704c012b159 debian-10-turnkey-etherpad_16.1-1_amd64.tar.gz $ sha512sum debian-10-turnkey-etherpad_16.1-1_amd64.tar.gz dd80993e8fc3b32cca63f0db21d2c91fbf999ae38b912efb91aab26b8309fe1a4533e2f9763b5ed0b5d95d608d844f0e2550f016c946cbbaeda6e5a1c67c8cde debian-10-turnkey-etherpad_16.1-1_amd64.tar.gz Note, you can compare hashes automatically:: $ sha256sum -c debian-10-turnkey-etherpad_16.1-1_amd64.tar.gz.hash debian-10-turnkey-etherpad_16.1-1_amd64.tar.gz: OK $ sha512sum -c debian-10-turnkey-etherpad_16.1-1_amd64.tar.gz.hash debian-10-turnkey-etherpad_16.1-1_amd64.tar.gz: OK Final note, when checking SHAs automatically, please ignore warning noting that some lines are improperly formatted. -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE8ZCki1TcVrLH8k3LrF6wBJPlvBwFAmB728gACgkQrF6wBJPl vBwsHg/+KsJ9xu0Ro7w03I1K9i4Q99Zi3c7N4+3kzG/8qOviqRdO5ekw0KTybPx2 r2GTIQIRPTfxlKX0GFT4u2/n2fi351UR6+Gt8SPGnnf531Mrnarn/iv181aGje6h AkvjdYVRTb0s85VD3Q5GIvOhcen3myRHPOdjkeAxfpok2xALdkopEtfpHkXI3sU7 kVMuwtt+wMqXzhvWQiE5KmXIxF3D9XSB4dbXm/IDUDBX+ERZsPUj5HmwuXuBH8j/ oqQTOD20QmeqQIC2vtG2BBa7Rsa7BkyYZH0pxoqNDL/9h09jyxMZbGZz4pnqji02 0Cqzi3xsP9fwS8pfb5RHoWW9ELSrDGlfTtPNliUJlMfR66JtL/EC13HblAxISMPd diUGS9IDBwAGlVxq4w3Hivr/EvVxnuxdeFLilLKBwIwdZVWQj++kDAGnFRsrwMJc OYfD5mw4ea6WO0wAXs8zbaGGGZyaA+5MhsPo6eVl2Xh7Bz7UYp4zApHjUNb/cMcc sTZCP8YVrtThr+ETNwwqoJOK7BoRB7MfTj0fE9zZ2YXdK9gxl1yigxVBMC3rXbM3 smVJvrecv2Mb6fvwSahEFCBo8QS0xqKA8JDDvuk8FKvvnzGhueFYqQXwF7T3mBlI 1WfssQLDwrCxKObC8Mi0QU21BeDED7yVMMeMkWWW0iw07HesMyU= =afA4 -----END PGP SIGNATURE-----