-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

To ensure the image has not been corrupted in transmit or tampered with,
perform the following two steps to cryptographically verify image integrity:

1. Verify the authenticity of this file by checking that it is signed with our
   GPG release key:

    $ curl https://raw.githubusercontent.com/turnkeylinux/common/master/keys/tkl-buster-images.asc | gpg --import
    $ gpg --list-keys --with-fingerprint release-buster-images@turnkeylinux.org
      pub   rsa4096 2020-02-05 [SC] [expires: 2040-01-31]
            A8B2 EF42 8781 9B03 D351  6CCA 7623 1C20 425E 9772
      uid           [ unknown] TurnKey GNU/Linux Buster Images (GPG signing key for TurnKey Linux Buster Images) <release-buster-images@turnkeylinux.org>
      sub   rsa4096 2020-02-05 [S] [expires: 2040-01-31]
      
    $ gpg --verify turnkey-drupal7-16.0-buster-amd64-vmdk.zip.hash
      gpg: Signature made using RSA key ID A8B2EF4287819B03D3516CCA76231C20425E9772
      gpg: Good signature from "0"

2. Recalculate the image hash and make sure it matches your choice of hash below.

    $ sha256sum turnkey-drupal7-16.0-buster-amd64-vmdk.zip
      5d9149c326d57ca4c7cf1654f687bb9fb0f6049bf7b463c8685fd4e06598d3ac  turnkey-drupal7-16.0-buster-amd64-vmdk.zip

    $ sha512sum turnkey-drupal7-16.0-buster-amd64-vmdk.zip
      088ccb7a73f36fb4c378e6fda6fa7d7bfbdbb9550a2ab0b448b5e559838a89f092f745a96609417a560501304071dcada1b5228298bb69ee76a8c55e1f38613e  turnkey-drupal7-16.0-buster-amd64-vmdk.zip

   Note, you can compare hashes automatically::

    $ sha256sum -c turnkey-drupal7-16.0-buster-amd64-vmdk.zip.hash
      turnkey-drupal7-16.0-buster-amd64-vmdk.zip: OK

    $ sha512sum -c turnkey-drupal7-16.0-buster-amd64-vmdk.zip.hash
      turnkey-drupal7-16.0-buster-amd64-vmdk.zip: OK

    Final note, when checking SHAs automatically, please ignore warning noting that some lines are improperly formatted.

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE8ZCki1TcVrLH8k3LrF6wBJPlvBwFAl8z2u8ACgkQrF6wBJPl
vBy2Pg/9GMY2iJyQIz1pGLFX2VTrKzndR9OgoptKlA91jjMqj+J/uhS24AROWump
Q9UKAYRmDes5SOq4CuXtUg0pVIZMhDWZyqkOOraQGRX0LFm12QC5oofLgDIzJ4Xm
a9vhSPfE2/7VoFAW8p3A9H7oqR8/aDHp+Lw/ogWoRthqQ/nXX5kFpf17tkSyfRB/
gBvb2weE3EgI9tlS0n4gMKgOfChVlPFBiAiWhpX5l4VkrmdV2HoOKe1rYMv2gEXj
DdM/VbzcXpcMacQGgx2rcRYBZnk/P32brZ3xfADfxd4moCSx4gFlJCltQeRijsBG
1qkv66QbUV8270B2VpZgE8MvNEkx8ELllUOpA7SzEklDjijoNbuFcY9lRStzVqkX
2dTX6TjmbOynJiVoWRWq2qHeJEcnUz7ufdIRQZCbGBYuphIj1TQDuRVT+auhpYs8
DnTMntuBvKLKS2b+RMWeU3KD4wkZMnN+/+AzACUaqmTLhQjkEm2CvGm1R9YWqsIw
Y5hLOwQb6o4fuK5u3/vfL3lDfUhWk14p2OeHXRhn1aciSUpNYFRlT/wkyadL6aXi
nqdXlItNZN6hGzMT0fipZIqtsivThveUnbi+74RK8nWnsvZpn6fZP1Lo2o3sMFCO
Hf5bO6Ais5JNIZeyAmBJVign+LgpW9KgID5tH+suZ6n/Sa3Ed50=
=lRIV
-----END PGP SIGNATURE-----