We take security seriously

Once you have downloaded an image, be sure to verify it for both security and integrity.

By calculating the image’s checksum on your own computer and comparing it to the original checksum, you can verify the image has not been tampered with or corrupted. Images are also gpg signed with Fedora keys to demonstrate their integrity.

• Click the verify button to download the checksum file for your downloaded image.

• Import Linuxrpms's GPG key(s)

                  curl -O https://linuxrpms.com/linuxrpms-gpg.pub
                

  You can verify the details of the GPG key(s) here.

• Verify the checksum file is valid

                  gpgv --keyring ./linuxrpms-gpg.pub rockylinux-*-CHECKSUM
                

                  gpgv --keyring ./linuxrpms-gpg.pub rockylinux-*-CHECKSUM
                

• Verify the checksum matches

                  sha256sum -c rockylinux-*-CHECKSUM
                

                  sha256sum -c rockylinux-*-CHECKSUM
                

If the output states that the file is valid, then it's ready to use!