-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

To ensure the image has not been corrupted in transmit or tampered with,
perform the following two steps to cryptographically verify image integrity:

1. Verify the authenticity of this file by checking that it is signed with our
   GPG release key:

    $ curl https://raw.githubusercontent.com/turnkeylinux/common/master/keys/tkl-buster-images.asc | gpg --import
    $ gpg --list-keys --with-fingerprint release-buster-images@turnkeylinux.org
      pub   rsa4096 2020-02-05 [SC] [expires: 2040-01-31]
            A8B2 EF42 8781 9B03 D351  6CCA 7623 1C20 425E 9772
      uid           [ unknown] TurnKey GNU/Linux Buster Images (GPG signing key for TurnKey Linux Buster Images) <release-buster-images@turnkeylinux.org>
      sub   rsa4096 2020-02-05 [S] [expires: 2040-01-31]
      
    $ gpg --verify turnkey-joomla3-16.1-buster-amd64-vmdk.zip.hash
      gpg: Signature made using RSA key ID A8B2EF4287819B03D3516CCA76231C20425E9772
      gpg: Good signature from "0"

2. Recalculate the image hash and make sure it matches your choice of hash below.

    $ sha256sum turnkey-joomla3-16.1-buster-amd64-vmdk.zip
      41c19732a51bcd6355e4f0ba96abfcd7ce9059b4a0db872a64df69ce7b51690c  turnkey-joomla3-16.1-buster-amd64-vmdk.zip

    $ sha512sum turnkey-joomla3-16.1-buster-amd64-vmdk.zip
      5f4bdf070dc9c2fcab49fb9cba676c0a489b6694f22bc8cbe40515ca260787f98e0bc25e1dbe6409236a86b63f34fb204b7e74575711e063e7e70d08ba35c8ea  turnkey-joomla3-16.1-buster-amd64-vmdk.zip

   Note, you can compare hashes automatically::

    $ sha256sum -c turnkey-joomla3-16.1-buster-amd64-vmdk.zip.hash
      turnkey-joomla3-16.1-buster-amd64-vmdk.zip: OK

    $ sha512sum -c turnkey-joomla3-16.1-buster-amd64-vmdk.zip.hash
      turnkey-joomla3-16.1-buster-amd64-vmdk.zip: OK

    Final note, when checking SHAs automatically, please ignore warning noting that some lines are improperly formatted.

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE8ZCki1TcVrLH8k3LrF6wBJPlvBwFAmA7b5sACgkQrF6wBJPl
vBxkOhAAwfcL6IFWDFye0GVE2uYimghbVsuMfPQqiOaXOJrdxf4xrV+2b4v989Cd
TRItp6neT/jn0TBphTuFjIIO7Z6HxQ3YHjQal0XTFfkVTgGzc9heS7EDUGvM71Fl
AppUN+wKO7vl4bPgdUByB3tHq4yiecF63dOmMTafDxqYKGE8dtKmHC4UvrVZzX3w
dmoYyIXBcESV7fMmmFQQVbJB6SOrHCiWog9m7uD6HHc27aiknm/CJdeChjSSctJh
gSg3XMpfT+3ufn3fTiWF+UFep9bu0L5joy2gdi4po1AYHCFgSHz0fZVXehkoXtJP
p2R9CO2foHL+7gJC5tVnHLwqbOI9JosVmq1Pxgcu2juPi26TrTu6rlFEDepa/5zx
eLBs0V6KYykWIeB9pDkclLuf9ILBSXwfnDxwpE5NzVU+KSojehMHTMv5Hse5CSOy
FqjFdlUEot1FQSoghwTwhlc6biaaSWZEdRsqnXIwKsVNUVeySbNjot00eEnYI+Jq
wQblwKaPu12QOH8As05cw7bF7e4jo8qNzKiRVvXeJiQB9B7fgwrHpDkmsfwezQ/9
MWQwltF2zJaH+RapPP6rtbSQ7/8Xy3oLHZHlxF+VZMu/lA31uq03Rt1XGSMLFAOi
d5SqHK/jWPWGhulYBBvEwPbb1iONGQaJOKBry/v2irB2F8DmdtU=
=hBiU
-----END PGP SIGNATURE-----