-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

To ensure the image has not been corrupted in transmit or tampered with,
perform the following two steps to cryptographically verify image integrity:

1. Verify the authenticity of this file by checking that it is signed with our
   GPG release key:

    $ curl https://raw.githubusercontent.com/turnkeylinux/common/master/keys/tkl-buster-images.asc | gpg --import
    $ gpg --list-keys --with-fingerprint release-buster-images@turnkeylinux.org
      pub   rsa4096 2020-02-05 [SC] [expires: 2040-01-31]
            A8B2 EF42 8781 9B03 D351  6CCA 7623 1C20 425E 9772
      uid           [ unknown] TurnKey GNU/Linux Buster Images (GPG signing key for TurnKey Linux Buster Images) <release-buster-images@turnkeylinux.org>
      sub   rsa4096 2020-02-05 [S] [expires: 2040-01-31]
      
    $ gpg --verify turnkey-gitea-16.1-buster-amd64.ova.hash
      gpg: Signature made using RSA key ID A8B2EF4287819B03D3516CCA76231C20425E9772
      gpg: Good signature from "0"

2. Recalculate the image hash and make sure it matches your choice of hash below.

    $ sha256sum turnkey-gitea-16.1-buster-amd64.ova
      d606a0886fbd1a69b3eaf0b5d615620d7b780a39d42bc3b85c339d7f9531214d  turnkey-gitea-16.1-buster-amd64.ova

    $ sha512sum turnkey-gitea-16.1-buster-amd64.ova
      857a32bdad5b0a5041e72cf41f5361435a9ef9f00a2a6cf4e3a3f3780f792c055e3ca2e332c9f7836a8de7ecf0e57c205616dea30aec248bd967093e07317594  turnkey-gitea-16.1-buster-amd64.ova

   Note, you can compare hashes automatically::

    $ sha256sum -c turnkey-gitea-16.1-buster-amd64.ova.hash
      turnkey-gitea-16.1-buster-amd64.ova: OK

    $ sha512sum -c turnkey-gitea-16.1-buster-amd64.ova.hash
      turnkey-gitea-16.1-buster-amd64.ova: OK

    Final note, when checking SHAs automatically, please ignore warning noting that some lines are improperly formatted.

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE8ZCki1TcVrLH8k3LrF6wBJPlvBwFAmA7b5kACgkQrF6wBJPl
vBx4ORAAgbTpZ0oIzyZ+xq3O3AIofc90jMRtzx1oBMjW0b4lf5YDzV6y33rEtECE
8SVMCy5LUHf84RznNHdJz/GbNAbhzqc6lpzGiz+KDEnk3nJcAwJbZDRPQl+A1VtS
svfsFnB9HKGdrsAEKRpLdxZ8vB1OxW8EHO+aPDKQ+pw2hJ3rOeLILG08p/9zJeKh
Jaj4VhufDWHJ1n6x80HT8XYfSS5ZRzgsGw0HkE4nZw3UvVP/zJoyg2iWixLvjeJn
GRXQ+NOpGZ5wyvcizh/OXdvIS1JANFudfgTZzfTGNI1FH2XsSr9fVIKidBzc7TwI
zOCU5feNsMOSOcxmEe6sKhCFRMNSVQX+EWkkmwAABmSNQhyHj/3yIyWTbHpU0LA6
m2SfxHwlkbKfmL5Ogupnqr/qWKP1ULR+R6G4wTXIjtf77GMoCnyK9R7D1M+xUSxR
KG4PXvjviNC3h8hMyvdjKN42BgvkVXkGRAOKa+F8PuoaqQqEGzc3x2KwirJt6Stk
V4ahE1eiuKPux4aP1FZjRjdcVIjZHPCGbL4HvinlgDy/nW/e9frpm25ZZ/dBDhiZ
FnC1wr+jag8TMw80Grg6ScDXCqJCzVNMzk3OKmo6axdMBvT4ViFpeahFDeX7lxMt
Ur5MtFWUC35O08cNS/Lju+XJzvkeHKDpeg21XF/CFW84YZqqV4k=
=V3RN
-----END PGP SIGNATURE-----