How to verify 9.0 iso

[RL1000]

Hi @iwalker,

Thanks for your reply.

My understanding is that it is important to verify the CHECKSUM file.

Many distros provide instructions on how to verify using a signature.

Eg Alma provides this in their 9.0 release notes:

9.0 | AlmaLinux Wiki

Download and verify a checksums list:

$ gpg --verify CHECKSUM

Also other users of Rocky have asked how to do this for previous versions such as

Verify checksum signature

Hey guise, I downloaded the torrent and there’s CHECKSUM{,.sig} in it. Verifying with sha256sum is easy, e.g. sha256sum -c CHECKSUM --ignore-missing So how about verifying the signature with gpg2? If I do gpg2 --verify CHECKSUM.sig CHECKSUM, I get Can't check signature: No public key. Of course it hasn’t been imported to my keyring yet, cus I couldn’t find it anywhere It’s always a good idea to verify downloads, especially binaries. …

And a solution was determined.

And the CHECKSUM.sig file was available for earlier versions of Rocky.

I am wondering why this file has not been made available for 9.0, and also why Rocky does not include verification instructions of the checksum file in release notes?