-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

To ensure the image has not been corrupted in transmit or tampered with,
perform the following two steps to cryptographically verify image integrity:

1. Verify the authenticity of this file by checking that it is signed with our
   GPG release key:

    $ curl https://raw.githubusercontent.com/turnkeylinux/common/master/keys/tkl-buster-images.asc | gpg --import
    $ gpg --list-keys --with-fingerprint release-buster-images@turnkeylinux.org
      pub   rsa4096 2020-02-05 [SC] [expires: 2040-01-31]
            A8B2 EF42 8781 9B03 D351  6CCA 7623 1C20 425E 9772
      uid           [ unknown] TurnKey GNU/Linux Buster Images (GPG signing key for TurnKey Linux Buster Images) <release-buster-images@turnkeylinux.org>
      sub   rsa4096 2020-02-05 [S] [expires: 2040-01-31]
      
    $ gpg --verify turnkey-cakephp-16.0-buster-amd64.ova.hash
      gpg: Signature made using RSA key ID A8B2EF4287819B03D3516CCA76231C20425E9772
      gpg: Good signature from "0"

2. Recalculate the image hash and make sure it matches your choice of hash below.

    $ sha256sum turnkey-cakephp-16.0-buster-amd64.ova
      f42c4005d485399a02b7a35094cc4c12138e91caa39e8c0d77f7d8b2fdd73966  turnkey-cakephp-16.0-buster-amd64.ova

    $ sha512sum turnkey-cakephp-16.0-buster-amd64.ova
      ddc0d10575406a608df90900fc134bde5eecaabd34994190faedd147f1b69ad685e1220466e22a866bc54e639f59c23043c18bf288d86b4a61f089c93af78c5c  turnkey-cakephp-16.0-buster-amd64.ova

   Note, you can compare hashes automatically::

    $ sha256sum -c turnkey-cakephp-16.0-buster-amd64.ova.hash
      turnkey-cakephp-16.0-buster-amd64.ova: OK

    $ sha512sum -c turnkey-cakephp-16.0-buster-amd64.ova.hash
      turnkey-cakephp-16.0-buster-amd64.ova: OK

    Final note, when checking SHAs automatically, please ignore warning noting that some lines are improperly formatted.

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE8ZCki1TcVrLH8k3LrF6wBJPlvBwFAl7KTbAACgkQrF6wBJPl
vBznFhAAy3m4f5C6Pl2tpWk7XTT5b2VUDG3n0orILAzUfCP5WBKCgWx84gbGLrVF
2fDB2YmC/fNPcvp44+oJCj4zakhIZa1lE61v73IXJ/F5wF5Azk0gK3fx4qT6GdXh
hD4qHI802qbgUVdDM3uEleXIJzBDhYp994M1FzKEYMEDfmZqfsnP3nT0UpdWJM3c
B+Zy0u4B1uC2wYTNSZvIkJ9nIW12c0oM3GWq+WbVA/WcZQ/br5K0jkPNMyRQNWYM
/W2cjs3rnprj8Dn21k5nabQk4dl9VsHJmCeTVueeZRqx9ZXYkUHcI6B/CrSqeUE9
Kcdg9gTGyz97fUmjy146Hwqp9BtjQkMx2AM2s1ugNWFwtCnb+qAffQ7L3dODHGGn
cmGIUVJ1QAcrOHq3BcjGX0aImlQUPiIyr4xBSdZ2akkFRzSF0AYFZ7amv5t4TRYy
GONxnSCnq6XhH5M75zjSL+332vEatIGq3CvHTPpJqqrRlS/ebjtjXrvL50WhUrNt
JMZfpWcl1+dNN8Cm/madirXtHaxEVdWuhDgolxb0MGYJCPvtpSXrB9YqD945sk9f
uH6ekxbWmYTMqdNiU6eUBURjK/hr4+JslEgrs69xUBU1EgZ4jdl6ah+jt/W1Snrj
k/3UqMECW0cdxOezsz+NIkJ4iZtpv3+6ybyEYcSbFy4AKuZW23g=
=1MUX
-----END PGP SIGNATURE-----