-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

To ensure the image has not been corrupted in transmit or tampered with,
perform the following two steps to cryptographically verify image integrity:

1. Verify the authenticity of this file by checking that it is signed with our
   GPG release key:

    $ curl https://raw.githubusercontent.com/turnkeylinux/common/master/keys/tkl-buster-images.asc | gpg --import
    $ gpg --list-keys --with-fingerprint release-buster-images@turnkeylinux.org
      pub   rsa4096 2020-02-05 [SC] [expires: 2040-01-31]
            A8B2 EF42 8781 9B03 D351  6CCA 7623 1C20 425E 9772
      uid           [ unknown] TurnKey GNU/Linux Buster Images (GPG signing key for TurnKey Linux Buster Images) <release-buster-images@turnkeylinux.org>
      sub   rsa4096 2020-02-05 [S] [expires: 2040-01-31]
      
    $ gpg --verify turnkey-lamp-16.0-buster-amd64.ova.hash
      gpg: Signature made using RSA key ID A8B2EF4287819B03D3516CCA76231C20425E9772
      gpg: Good signature from "0"

2. Recalculate the image hash and make sure it matches your choice of hash below.

    $ sha256sum turnkey-lamp-16.0-buster-amd64.ova
      d91f38721947f0c73f19fb384f3be26107421a60a56388896591ddac94799838  turnkey-lamp-16.0-buster-amd64.ova

    $ sha512sum turnkey-lamp-16.0-buster-amd64.ova
      46d97fbd6bfef6d368e33dc7a4804e2523b9addcbff415e1b7ff9cc91ee4fc970f4472b2d45d111de678a64ded9983aa2227a3044ecd9cf15ddfdddb69fada88  turnkey-lamp-16.0-buster-amd64.ova

   Note, you can compare hashes automatically::

    $ sha256sum -c turnkey-lamp-16.0-buster-amd64.ova.hash
      turnkey-lamp-16.0-buster-amd64.ova: OK

    $ sha512sum -c turnkey-lamp-16.0-buster-amd64.ova.hash
      turnkey-lamp-16.0-buster-amd64.ova: OK

    Final note, when checking SHAs automatically, please ignore warning noting that some lines are improperly formatted.

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE8ZCki1TcVrLH8k3LrF6wBJPlvBwFAl7KTbQACgkQrF6wBJPl
vBwWvRAAwmiMMk9nrlx0QSgexb4nG3bdIbvUaUaZ4FK/YVGd9sHpc4YT2St599/s
Kmcc3mA/oCX6Q9LJiEqU6KUg7Pt3adkKSWY2z9G5l7b8qZFGPlyq9Y3cvJTmdmDi
lJ6QHOxCG8/Vf8s1AK4VzI23rRMlu2Z32M0ky0B7QLuB05XUCYZ3cH1nuktQOwx4
wrtK8QtDOBRG+AqhMI+vMqmhxBLkvI7r860iImGzKTZVDnaic7JM40O6MtD+UM2H
enEF/fwQeQE3fRC5h9v1gbVnGZoY9FTxM44A+fCzLuHx5hm+TW3MtHr+LcXZ5lR8
/QskQXQ1Lfg6jkDX+FHPWLhXSgGivYgebwq+0HPa0DrhKUzorq91VIttarw8zvp8
HkSV45KPUk1F/PuxzNRWStfj1Ldb/4tSHUdX9x5Y3vKRs4q4IAT8kqul28bpCM2m
ctZJ5nHGBV6g+wwWWTteEnGcV9Tyjxl4l41+L1tq6xmLJIq0J10ZrRvZatOt9nDM
5lUSqE9H98U4YfWo3QlXz1hWaKkfCWOcuUxhlkTG5tGdiUAdxEoPYVRNGur91qpf
lNGe2aYTWFWPigFRUXSBZ0S867xNRhatYVd5b2Iziiv4xOT3T9wn2Z6MOycOstDf
86v0tbTQNrN7eMU9aq46KG7N3fliLH8JZZ1IWXfsRvEH8L6G6V8=
=QDsJ
-----END PGP SIGNATURE-----