Fedora Keeps You Safe

Use Verified Checksums to Verify Your Downloads

If your download comes with a signed CHECKSUM file, use the following procedure to verify your image for both security and integrity.

• Download Fedora's OpenPGP certificates.

  curl -O -O https://fedoraproject.org/fedora.{pgp,gpg}

• Inspect the details of Fedora's OpenPGP certificates.
  You can use sq or gpg to display the certificate details.

  sq keyring list fedora.pgp

  gpg --with-fingerprint --show-keys --keyid-format long fedora.gpg

  You can verify the details of the OpenPGP certificates below.

  TIP: If you use sq to display the fingerprints, you can copy them from the terminal and use your browser's page search function to match them on this page.

• Use the verified checksum(s) to verify the download(s).
  You can use sq or gpgv to verify the checksum file(s).

  for file in *-CHECKSUM; do
                    sq verify --cleartext --signer-file ./fedora.pgp \
                      "$file" \
                      | sha256sum -c --ignore-missing
                  done
                

  for file in *-CHECKSUM; do
                    gpgv --keyring ./fedora.gpg --output - \
                      "$file" \
                      | sha256sum -c --ignore-missing
                  done
                

If the output states that the file is valid, then it's ready to use!