Check your download
How to verify
When the release is available, download the ISO, its SHA256 file, and its detached signature. The exact filenames and signing-key details will be published with it.
- Keep the ISO and checksum file together. From that folder, check the checksum:
sha256sum -c SHA256SUMSSHA256SUMSis a placeholder filename. The result for the ISO must say OK. - Obtain the release signing key and compare its fingerprint with the published fingerprint before importing it.
- Verify the detached signature:
gpg --verify RELEASE.iso.sig RELEASE.isoReplace both placeholder filenames with the release filenames. Check that the signature is good and belongs to the verified release key. If either check fails, do not install that image.