-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

To ensure the image has not been corrupted in transmit or tampered with,
perform the following two steps to cryptographically verify image integrity:

1. Verify the authenticity of this file by checking that it is signed with our
   GPG release key:

    $ curl https://raw.githubusercontent.com/turnkeylinux/common/master/keys/tkl-buster-images.asc | gpg --import
    $ gpg --list-keys --with-fingerprint release-buster-images@turnkeylinux.org
      pub   rsa4096 2020-02-05 [SC] [expires: 2040-01-31]
            A8B2 EF42 8781 9B03 D351  6CCA 7623 1C20 425E 9772
      uid           [ unknown] TurnKey GNU/Linux Buster Images (GPG signing key for TurnKey Linux Buster Images) <release-buster-images@turnkeylinux.org>
      sub   rsa4096 2020-02-05 [S] [expires: 2040-01-31]
      
    $ gpg --verify turnkey-typo3-16.0-buster-amd64-vmdk.zip.hash
      gpg: Signature made using RSA key ID A8B2EF4287819B03D3516CCA76231C20425E9772
      gpg: Good signature from "0"

2. Recalculate the image hash and make sure it matches your choice of hash below.

    $ sha256sum turnkey-typo3-16.0-buster-amd64-vmdk.zip
      9376ffabd0f80dbdad68b4b301431c65b0ea28aa8036542ddafcd4eb4fd0d62a  turnkey-typo3-16.0-buster-amd64-vmdk.zip

    $ sha512sum turnkey-typo3-16.0-buster-amd64-vmdk.zip
      7a2b1052ab8106e5995c81c14a422a71add47e2e311beea1d889cd753880dd6ef62eb720a91b0586a08a10477cbe3c9880c5df9b647d13d1964ad9ecab0a38db  turnkey-typo3-16.0-buster-amd64-vmdk.zip

   Note, you can compare hashes automatically::

    $ sha256sum -c turnkey-typo3-16.0-buster-amd64-vmdk.zip.hash
      turnkey-typo3-16.0-buster-amd64-vmdk.zip: OK

    $ sha512sum -c turnkey-typo3-16.0-buster-amd64-vmdk.zip.hash
      turnkey-typo3-16.0-buster-amd64-vmdk.zip: OK

    Final note, when checking SHAs automatically, please ignore warning noting that some lines are improperly formatted.

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE8ZCki1TcVrLH8k3LrF6wBJPlvBwFAl7vE50ACgkQrF6wBJPl
vBwvxA/9HIvra+ZqOUZPQc1aCyDpr33bGZicWZlV6Mf03ZoyXqPF+XM7p/t8G5eW
AJzyJg0053qW3dOm97kAs4sacjNieVDKkTG5v8BR5ekq47fGYcRX56Aosynjcf+l
qw8dPtnq9jCdiRksUJRpTKntWB1+njyM+fJ9bt0klaYIG6w8/HsnOodBNWeeT7mb
zikcaou+Lt/fNPoOO0XOPQSXYpX5VxtQFBuGwNcCmySoTZhps6vhkS0C9Ej6XHAn
svJ1PwTur5yrDTOMqPlnqtFyo9/lZXiBaP5kMbSJjrnwkiF1679bHxU9l8P5kRp1
06s6KVWIjZKait/XH7caUk1c2z9uOWVfXi3aqvjV8w/yML1LHxbJBDK1/cK4lXGi
NcMCa/02tuiV+YqQTyfGck75MBBXuGlm8asHYWKHXhm+Xea7JZv4zCzRZ6FQAv+j
jedq6kqd13SUBMqJBac/mczd9mlpuRqUjOlFNll7DSKelSgmkvAU+Bdbf0h/sch2
rjq34LY6B6ZTB6ixjzOCZjFRRqGlMRs7VjZUAYSXcHP5jtmpy+qNd3CUjxpdNI4F
AvoKw2R9bRouhuHrDbDOG7eaq7d9Ag1U2hhWhwsBHMEItiWc6+CT1odzOilGA5+F
ikODpLtYMzJ/VdP9K2CDixADeNMFwSP97njE0hwBuXsZR3RHGVU=
=UG1l
-----END PGP SIGNATURE-----