Checksums

Every release, snapshot and archive directory contains a SHA256SUMS file listing the SHA-256 digest of each file in that directory. Where upstream publishes signatures, the signature file is mirrored next to it unchanged.

Verifying a download

sha256sum -c SHA256SUMS --ignore-missing

On systems without sha256sum, compute the digest with your platform's tool and compare it with the matching line of SHA256SUMS.

Why verify?

• Large transfers can be interrupted or corrupted; a checksum confirms the file is complete.
• This mirror is not an original publisher. Check signatures against the upstream project's own published keys before trusting an image.