-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Two steps are required to cryptographically verify image integrity. 1. By verifying the integrity of this signature file, you can be sure that the checksums included in this file are valid. $ gpg --keyserver hkp://pool.sks-keyservers.net --recv-keys 0xA16EB94D $ gpg --list-keys 0xA16EB94D pub 2048R/A16EB94D 2008-08-15 [expires: 2023-08-12] uid Turnkey Linux Release Key $ gpg --verify turnkey-yiiframework-14.0-jessie-amd64.iso.sig gpg: Good signature from "Turnkey Linux Release Key" 2. By calculating the image checksum and validating the hashed value is the same as listed below, you can be sure the image was not corrupted in transit or tampered with. $ md5sum turnkey-yiiframework-14.0-jessie-amd64.iso eca36c9794091617c0389bec0382f9c4 $ sha1sum turnkey-yiiframework-14.0-jessie-amd64.iso 0a9b798cd0174dc853fe1e586a21dba1e5484259 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQEcBAEBAgAGBQJV7BrrAAoJEIXCXpWhbrlN4CUH/jlm1touLi42iqgSXkero/Hn qhGUSpQf4iSDUvaC4MWWxFrPiwbipCM2p7sB66Ci9eFiSi6XIkqQyTSHr7kfWpwk ydcKQ+12jXbSkCODSX7pxSVgvtuWjLa9i1J+2ojN1Sawpx4h7I5mMZijH1RwrXKb y54Qgu2hub1OCTmgehcoptvlHQMIHE0MqehVWRavan3KxqfrRX23tT3ex7uvsXDb uNRytsfXTookUqqZ46EGjPDIpyDzbRa4HWfa5TR5ruMObD+yQ24EHTqJHF9mZZN8 J5CA5uB2tuKBnMqNdqyneda+gmPPupRTbDQodW3k5rZRFACUSH2N4/CaDFo1pFY= =4tbM -----END PGP SIGNATURE-----