-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

To ensure the image has not been corrupted in transmit or tampered with,
perform the following two steps to cryptographically verify image integrity:

1. Verify the authenticity of this file by checking that it is signed with our
   GPG release key:

    $ curl https://raw.githubusercontent.com/turnkeylinux/common/master/keys/tkl-buster-images.asc | gpg --import
    $ gpg --list-keys --with-fingerprint release-buster-images@turnkeylinux.org
      pub   rsa4096 2020-02-05 [SC] [expires: 2040-01-31]
            A8B2 EF42 8781 9B03 D351  6CCA 7623 1C20 425E 9772
      uid           [ unknown] TurnKey GNU/Linux Buster Images (GPG signing key for TurnKey Linux Buster Images) <release-buster-images@turnkeylinux.org>
      sub   rsa4096 2020-02-05 [S] [expires: 2040-01-31]
      
    $ gpg --verify turnkey-domain-controller-16.1-buster-amd64.ova.hash
      gpg: Signature made using RSA key ID A8B2EF4287819B03D3516CCA76231C20425E9772
      gpg: Good signature from "0"

2. Recalculate the image hash and make sure it matches your choice of hash below.

    $ sha256sum turnkey-domain-controller-16.1-buster-amd64.ova
      58fe16424ca239e072c626b95855e73278795fb0aa3ab9aeb8551ca6c6260950  turnkey-domain-controller-16.1-buster-amd64.ova

    $ sha512sum turnkey-domain-controller-16.1-buster-amd64.ova
      241d376e87d40ae529fb867b83ffc6eeeb5ca84a330ab95a35082ff1eba3143c5452fd04a0b335179ea59f370a9789ea0ef396834ac17c9f611ddac0c0e788bf  turnkey-domain-controller-16.1-buster-amd64.ova

   Note, you can compare hashes automatically::

    $ sha256sum -c turnkey-domain-controller-16.1-buster-amd64.ova.hash
      turnkey-domain-controller-16.1-buster-amd64.ova: OK

    $ sha512sum -c turnkey-domain-controller-16.1-buster-amd64.ova.hash
      turnkey-domain-controller-16.1-buster-amd64.ova: OK

    Final note, when checking SHAs automatically, please ignore warning noting that some lines are improperly formatted.

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE8ZCki1TcVrLH8k3LrF6wBJPlvBwFAmCzPrcACgkQrF6wBJPl
vBykjA/+N917cY/oFzN8hLU9EgfGpqElETFeYVvYyxw8peXx3IoV5HCg7eL5Fszj
JyUS8bxz8Oq1A+ql7C45hEXhFVXaeu7MMVhTahfZixmQQw6bOmU4LsdRaZQVNBC8
X7C5O7xBNqU1XhVaYIkI9hvMLQcG5xBf4f6CesH9Y7b66rg30x/4o1I8NQmpY+5m
Q7BCZX+FMrVT+0hwwWkmegOZzuYMGRovtvKylbhzWCgV9I1+9OsCTJ4CZDgNAc9a
RvtQV66si1ZORIANNeWFH0WrpikPPfMui/TjrwXm8CxzleQdXADrhYYU+HhxmSrr
F5OomOIUOxhtcIY9IFnQ3uUbgNIA7EAqdctjOUu/opXTQhtu0JlCnUy78tcev6O2
6jS55I3x5LldOq0oWyqf9DBHNHpQxVV/l/pCkI6ZIpMMD/fmrOyQJsXlZ2PRT0ni
VWMmrz/pyDKRJa5WBxA07f7RpYD09PFhOIuorSoQsEa1L/uqvb2pR8pgGtqzRbhd
drKSDuVR10Q3WaYp60E6EJOgDhoOujZjKHQ3++V3yakm+FafXzvI0XhGWf1sHgI5
yFfYwEE0duUsQOYnAPfN610Sv/1YPdR/cM9G+AtoorgIv2lltgks8hKdJaqx1Ob1
qtZMtJ5xRI9Z53ciMUoUXIG8Oey0mlpf2GWcuUm5ycupNeZMsiY=
=tAOE
-----END PGP SIGNATURE-----