-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

To ensure the image has not been corrupted in transmit or tampered with,
perform the following two steps to cryptographically verify image integrity:

1. Verify the authenticity of this file by checking that it is signed with our
   GPG release key:

    $ curl https://raw.githubusercontent.com/turnkeylinux/common/master/keys/tkl-buster-images.asc | gpg --import
    $ gpg --list-keys --with-fingerprint release-buster-images@turnkeylinux.org
      pub   rsa4096 2020-02-05 [SC] [expires: 2040-01-31]
            A8B2 EF42 8781 9B03 D351  6CCA 7623 1C20 425E 9772
      uid           [ unknown] TurnKey GNU/Linux Buster Images (GPG signing key for TurnKey Linux Buster Images) <release-buster-images@turnkeylinux.org>
      sub   rsa4096 2020-02-05 [S] [expires: 2040-01-31]
      
    $ gpg --verify turnkey-orangehrm-16.0-buster-amd64.ova.hash
      gpg: Signature made using RSA key ID A8B2EF4287819B03D3516CCA76231C20425E9772
      gpg: Good signature from "0"

2. Recalculate the image hash and make sure it matches your choice of hash below.

    $ sha256sum turnkey-orangehrm-16.0-buster-amd64.ova
      1f720bab71a43b1c4e44f2472aa45a2f3b55f4c1edbb8c224b89f11b0e62faab  turnkey-orangehrm-16.0-buster-amd64.ova

    $ sha512sum turnkey-orangehrm-16.0-buster-amd64.ova
      b14cc2f6ab512cfc2bb4c74921de42fefaedaefd09a531c7ba2aa609021536bb9a623472465ac1f26202f73d3c8ac874ff508a266ed17146cde0b1aef40e5d6d  turnkey-orangehrm-16.0-buster-amd64.ova

   Note, you can compare hashes automatically::

    $ sha256sum -c turnkey-orangehrm-16.0-buster-amd64.ova.hash
      turnkey-orangehrm-16.0-buster-amd64.ova: OK

    $ sha512sum -c turnkey-orangehrm-16.0-buster-amd64.ova.hash
      turnkey-orangehrm-16.0-buster-amd64.ova: OK

    Final note, when checking SHAs automatically, please ignore warning noting that some lines are improperly formatted.

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE8ZCki1TcVrLH8k3LrF6wBJPlvBwFAl7vE5oACgkQrF6wBJPl
vBxGwxAA0VHWjHKd7Yn68uT7aRzkj9hlOrsx71JbhFtwpheV74OC1sAFKPMGm5/t
bXD0Qqw8QbvBzDZx+FJ1uyAM7dwpszqVlCS29Cwejtujr+uuQVBClHRwbLfRQ2RL
2HAq7tu/UGbWTE0STD1Xw0TEPzOI5l94mqB+RNSEEnmsKplVbVe+SXFBZl/sbjpc
d3HMWpXfbziakf0nMe/2gYALmwLjJpcfEIr52WYPiDa3Do9FDCnNhQka8q0fXpGI
ZDD4nzF+mjvq9UQDXcXHwC9yVJ08+5XTTp1pjWc4RHUT71OXG+k6Unq/tBa55RPO
X2uN8KIlmpc1e33ak674s3eIoqnZ6N3XwI7qhD5bcNCfJpulJSnOavtjZqGCwknw
C8TDQSHi6KTZer/O0hzxokomVWA8x3s/rD5ToGyGv5wyPX9xKC+dFqbE/u9s35E9
3+r0TyqQIn/izmL2iSBafYuHuf8KNKjwC7YR7jlFqCVktLZoiifPAGeWljJwa5jC
BppbhvsBwSNkEBI5gf1Y6zm4XSzr+ULi87Y+DOIV/NTS1WEmE/2UJyCh98RsZR9p
nij8wk/v+2b7NMnLJQoVkc41rY4XAwvD4xD/ZRko8eaB2qIEojjPlkma/vQbvC76
KuQOyzlmCDa76DvSit3Tv2A3yOv1mJ6v9f0q+m0PU4ZxkimEu3A=
=Z0/g
-----END PGP SIGNATURE-----