-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

To ensure the image has not been corrupted in transmit or tampered with,
perform the following two steps to cryptographically verify image integrity:

1. Verify the authenticity of this file by checking that it is signed with our
   GPG release key:

    $ curl https://raw.githubusercontent.com/turnkeylinux/common/master/keys/tkl-buster-images.asc | gpg --import
    $ gpg --list-keys --with-fingerprint release-buster-images@turnkeylinux.org
      pub   rsa4096 2020-02-05 [SC] [expires: 2040-01-31]
            A8B2 EF42 8781 9B03 D351  6CCA 7623 1C20 425E 9772
      uid           [ unknown] TurnKey GNU/Linux Buster Images (GPG signing key for TurnKey Linux Buster Images) <release-buster-images@turnkeylinux.org>
      sub   rsa4096 2020-02-05 [S] [expires: 2040-01-31]
      
    $ gpg --verify turnkey-tomcat-16.1-buster-amd64.iso.hash
      gpg: Signature made using RSA key ID A8B2EF4287819B03D3516CCA76231C20425E9772
      gpg: Good signature from "0"

2. Recalculate the image hash and make sure it matches your choice of hash below.

    $ sha256sum turnkey-tomcat-16.1-buster-amd64.iso
      70478cf72d7b2968b99153cb7be6ed753612e704bd27a9f60a52ef0a59335018  turnkey-tomcat-16.1-buster-amd64.iso

    $ sha512sum turnkey-tomcat-16.1-buster-amd64.iso
      08ba43d163f1c6d51fc9907c31ab37cfefefbddbbdbb54f477977385b27591723f514fa923c12a1068b2a4bad482cc660dbc4ee247f33114175979b4eb385704  turnkey-tomcat-16.1-buster-amd64.iso

   Note, you can compare hashes automatically::

    $ sha256sum -c turnkey-tomcat-16.1-buster-amd64.iso.hash
      turnkey-tomcat-16.1-buster-amd64.iso: OK

    $ sha512sum -c turnkey-tomcat-16.1-buster-amd64.iso.hash
      turnkey-tomcat-16.1-buster-amd64.iso: OK

    Final note, when checking SHAs automatically, please ignore warning noting that some lines are improperly formatted.

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE8ZCki1TcVrLH8k3LrF6wBJPlvBwFAmB729MACgkQrF6wBJPl
vBx8tw/8D3kSxskwFn9f1HojjM425fT1NfXNO3LiysGgHAQ+70CbDrzlqfhLX7El
n3XunMs2+arevp8yHxiGZbJOmniJK9v9yhh6+sJWsYLvY1ko3XOSE561M+XWbHIT
74p6rRtrEOQfsvm4iqqSBFT4C+/IoMbQTxaYwkdhX5Eox92a3nh3U28gKp3jgmjN
PFIenCn+bIkiD2JCEGit8kv1w8xiGSvNRv3z/DrtwPqLaOpElt0LL4YODGT9VnLY
8FzFolcx9VoAjBQhBudTNbLx+2VXRkpdFw7D9VSX3rpUWqXJhOxkNyKu9tj3mckn
tzkohlip/rZbLlJlTvjM7bFKEiCNI8+E92LY6mElRfGW5fqhEEz2qbpB70pWtuRB
KO2nCT4Kf9kdGYh92WvpWcVxD+aMEhvhy7M6dSA7EsU9oSittIxwZTB3x9dTzrH7
m/GEAEvokivktwuH3Syer/lWI8U9uZIU0gbWXSJu41fleggzOsqXoAsmuP3aaqB5
xrxSF83t9STB5r8B22aM52ehjJEs8THtwk5d/T+CyxeT5Mu9vHG7YOmypi5l3n07
T6vKA3zrlttrATlBiOaP1xiRca/d76mUM5i7joZfQ/tKdhnx28pwwiNcwGCx17Xu
5zsbIFZlfElTEDU6k/AairQ/J5keBQ7QfGO0zuj4QilE7gt0DMA=
=k0V0
-----END PGP SIGNATURE-----