Verify your download

Check that the image is complete and that it comes from Padmini Systems, before you start it.

Each release has a checksum list, SHA256SUMS, with the SHA-256 of every file in the release. Padmini's release key signs the list: SHA256SUMS.asc. Two checks follow from that:

1. The signature shows that the list comes from Padmini Systems and was not changed.
2. The checksum shows that your file matches the list: complete and unchanged.

The release key

Compare the fingerprint with the one gpg shows. When in doubt, ask us on support@padminisys.com or by phone before you trust a key.

Linux

cd ~/Downloads        # where the image is
curl -LO https://downloads.gate42.in/releases/1.8.2/SHA256SUMS
curl -LO https://downloads.gate42.in/releases/1.8.2/SHA256SUMS.asc
curl -LO https://downloads.gate42.in/gate42-release-key.asc

gpg --import gate42-release-key.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum --ignore-missing -c SHA256SUMS

gpg must print Good signature from "gate42 release signing key (Padmini Systems)", and sha256sum must print OK for your file. gpg also warns that the key "is not certified with a trusted signature": that is normal for a key you have just imported. The fingerprint check above is what makes it trustworthy.

macOS

The same, with shasum -a 256 -c SHA256SUMS instead of sha256sum. gpg comes with GPG Suite or Homebrew (brew install gnupg).

Windows

In PowerShell, in the folder with the image:

Get-FileHash .\gate42-1.8.2-b17-amd64.qcow2 -Algorithm SHA256

Compare the hash with the line for the image in SHA256SUMS. To check the signature, install Gpg4win and run the same gpg commands as on Linux.

If a check fails

Do not use the file. Download it again: a broken download is the usual cause. If the signature check fails, or the checksum still does not match, tell us at support@padminisys.com.