-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

To ensure the image has not been corrupted in transmit or tampered with,
perform the following two steps to cryptographically verify image integrity:

1. Verify the authenticity of this file by checking that it is signed with our
   GPG release key:

    $ curl https://raw.githubusercontent.com/turnkeylinux/common/master/keys/tkl-buster-images.asc | gpg --import
    $ gpg --list-keys --with-fingerprint release-buster-images@turnkeylinux.org
      pub   rsa4096 2020-02-05 [SC] [expires: 2040-01-31]
            A8B2 EF42 8781 9B03 D351  6CCA 7623 1C20 425E 9772
      uid           [ unknown] TurnKey GNU/Linux Buster Images (GPG signing key for TurnKey Linux Buster Images) <release-buster-images@turnkeylinux.org>
      sub   rsa4096 2020-02-05 [S] [expires: 2040-01-31]
      
    $ gpg --verify turnkey-jenkins-16.0-buster-amd64.ova.hash
      gpg: Signature made using RSA key ID A8B2EF4287819B03D3516CCA76231C20425E9772
      gpg: Good signature from "0"

2. Recalculate the image hash and make sure it matches your choice of hash below.

    $ sha256sum turnkey-jenkins-16.0-buster-amd64.ova
      b9d7f3479e223f32ad99449323a6db4cff9f15a9b2d3ced70769dc636155c41d  turnkey-jenkins-16.0-buster-amd64.ova

    $ sha512sum turnkey-jenkins-16.0-buster-amd64.ova
      81d2815375c6fe208388102fa9b8874d540205107ccd76883f6d57ac0b473702d9b7de3b656057ad4fcbc8e90db44c31987046081b6fadc903eb121c72f847f5  turnkey-jenkins-16.0-buster-amd64.ova

   Note, you can compare hashes automatically::

    $ sha256sum -c turnkey-jenkins-16.0-buster-amd64.ova.hash
      turnkey-jenkins-16.0-buster-amd64.ova: OK

    $ sha512sum -c turnkey-jenkins-16.0-buster-amd64.ova.hash
      turnkey-jenkins-16.0-buster-amd64.ova: OK

    Final note, when checking SHAs automatically, please ignore warning noting that some lines are improperly formatted.

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE8ZCki1TcVrLH8k3LrF6wBJPlvBwFAl8z2u8ACgkQrF6wBJPl
vBzU6g/9H5l7lErKOLAbj8zif3G4J1xjHIs4/yu2dVzXDWUbcVwWYOZQqmFtpB92
OIx1ANgBQoJUorcQUfW8OexZ70z9XzFxXSooIs8G2ANZLzaS5uMD6hY5zAc+zxe9
Lxw2N+5jn2qNegyTk1BPEJ3igWAbJIcd2IDo7OctBSHsAL+c4o3NeDRQBX8YTb/b
s4/Za1HVRnz3+SSV+MJLl3fBRxdvFUXCcPb0mYJ5hiwJ6bMS2EtsDiAN3MHeaQsa
NP57ixtWjf73H3CtaqKhYA2ZFR9txqxkv3LGoCcc1N2ND3r6vaKSDqqXXUVsHQy1
v4NmkneuZ8KI/XtuPhDUmR4AP7NvSDtI8tXqIRj1nfrFvS5MdYpZHIOIAjII8s3H
aQ6jC5zj27eaA9k/fePj0z4lfasAmnWNrOotvqalXa6WHjT1Z0TSZjHlhYzjP5/O
tWdTmrk8WxF3Kfjo+e4E9IiEefhQ+L2Mh9UdWrjdErWyC5AIbUp6XVkzEScZ4ZVa
1hw9K+bVujznpIW6zehLuTWhLOrTRl+2muGuMpx6AFg3ZdHTRL8/nkQcVmNqvIzH
cl6dOF0o7wn8mQhUia+T/d/51Uk+Rd2WM5JViba23k3MbOgSRyLpA+hU56ZW6EDL
ui6gBcQJyPJ2kuqx5ZoHU+5nVofeCOXUC+2Aa6iXGzQxGRmniKQ=
=EYOU
-----END PGP SIGNATURE-----