-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

To ensure the image has not been corrupted in transmit or tampered with,
perform the following two steps to cryptographically verify image integrity:

1. Verify the authenticity of this file by checking that it is signed with our
   GPG release key:

    $ curl https://raw.githubusercontent.com/turnkeylinux/common/master/keys/tkl-buster-images.asc | gpg --import
    $ gpg --list-keys --with-fingerprint release-buster-images@turnkeylinux.org
      pub   rsa4096 2020-02-05 [SC] [expires: 2040-01-31]
            A8B2 EF42 8781 9B03 D351  6CCA 7623 1C20 425E 9772
      uid           [ unknown] TurnKey GNU/Linux Buster Images (GPG signing key for TurnKey Linux Buster Images) <release-buster-images@turnkeylinux.org>
      sub   rsa4096 2020-02-05 [S] [expires: 2040-01-31]
      
    $ gpg --verify turnkey-tkldev-16.0-buster-amd64.ova.hash
      gpg: Signature made using RSA key ID A8B2EF4287819B03D3516CCA76231C20425E9772
      gpg: Good signature from "0"

2. Recalculate the image hash and make sure it matches your choice of hash below.

    $ sha256sum turnkey-tkldev-16.0-buster-amd64.ova
      40a63877c686545679180dce702acbfb011926f710354d79e86360d19d6e5630  turnkey-tkldev-16.0-buster-amd64.ova

    $ sha512sum turnkey-tkldev-16.0-buster-amd64.ova
      31ba07f20e58114bbd1660e03e09b5625c03cb73873ef6edfed42b8fba6b96bdbf70e2dc1ae254fdeb05bf96c87750b83f662cb7c645b0e01f326dafb6526d88  turnkey-tkldev-16.0-buster-amd64.ova

   Note, you can compare hashes automatically::

    $ sha256sum -c turnkey-tkldev-16.0-buster-amd64.ova.hash
      turnkey-tkldev-16.0-buster-amd64.ova: OK

    $ sha512sum -c turnkey-tkldev-16.0-buster-amd64.ova.hash
      turnkey-tkldev-16.0-buster-amd64.ova: OK

    Final note, when checking SHAs automatically, please ignore warning noting that some lines are improperly formatted.

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE8ZCki1TcVrLH8k3LrF6wBJPlvBwFAl7KTbsACgkQrF6wBJPl
vBy2mxAAkB6IbRtdd8cx/YYvCh7CbXYy0WH/b7AhuZb6qVFAPGq+ai1rn7VzURvb
hxH0W0/CRr9xCI/VQq7viZCcb4RSGbrCUYn4/mE9L+BLcOcSXhN203EY+IlAyr9l
gNM2zdp0lMc/+bg2TtOcjmyzUM8sPXCI1CL8AgiFVrILEBbiWA/4pSzLDz9RCq85
ayHNyUt9VnmDO3DBvdv9L1/A4ppi+OBGRtzpd9/IGR0RqkLJTpet04xX18OCnbbo
kCVKy/bVUMECSrfqLsTpZRwYnB/bLw26tklPS6coAfA74cZFqn4XD+srWi6TtG4q
eSZGLEx1h04a1uKKCoiy05EuVPh77HA4mn8cAAcf9nwJySXV6VGjtQb05RpltQhd
kdpH0hsIIVKEeooA/Ij8EwwkkoGJULOchMKUd+Q7Lw1w2BiBCNIt+GOtejNaSwTQ
AFLK95iHREOR0uWURcTALn/ftIFWrEAfsxfpwkjD6mElfxsygZVmNItCHNU0l2dW
1A9Q9WoOdd80skt9011RKeo4iZq0FiRBDkoUF85xgRB5IB+6pZXyhAOtZD73FuWN
HqpEEeLW/BW4sDM2284mxyH5pR7v6g4AOVbK+DAlXB7dwHigPEB54kC3yZ8WNrRE
zBEqw2mFoHPwRbNWNfiQJhpj7f+qmC85Pg7kCzXJ1e7/vhKtT9o=
=57n5
-----END PGP SIGNATURE-----