I've just downloaded a FreeBSD 11.0 iso file from the FreeBSD website. I've also obtained the signed SHA512 and SHA256 checksum files. The website says that the checksum files are PGP-signed. How do I verify the integrity of the downloaded iso? Where do I get the public key to verify the signature in the checksum files?


If you are in a Linux / Unix-like system,

sha256sum /path/to/freebsd.iso
sha512sum /path/to/freebsd.iso

will print the checksums.

The public PGP key is likely one of these.

  • Do you know which key exactly? I downloaded the complete keyring. The download was successfully verified, but now I have hundreds(?) of keys I'll not be using again. – Flux Feb 26 '17 at 12:33
  • It turns out this piece of information is really hard to find in the internet. I did some research but could not find it. This should be explicitly documented somewhere. I think you could infer it from your local keyring (a good topic for another question) and then, if you want, send a suggestion to FreeBSD developers to document it explicitly in the Download page. – thiagowfx Feb 26 '17 at 18:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.