There is no problem here in fedora 34 workstation (host).
[chris@f34 verify-centos]$ ll
total 741388
-rw-r--r--. 1 chris chris 759169024 Jun 5 11:46 CentOS-Stream-8-x86_64-20210603-boot.iso
-rw-r--r--. 1 chris chris 355 Jun 5 15:15 CHECKSUM
-rw-r--r--. 1 chris chris 811 Jun 5 15:17 CHECKSUM.asc
-rw-r--r--. 1 chris chris 1683 Jun 5 17:30 RPM-GPG-KEY-CentOS-Official
[chris@f34 verify-centos]$
Remember that the pgp-signature files like CHECKSUM.asc is generate by another file.
I suppose the procedure of the Centos team was approximately the following.
sha256sum CentOS-Stream-8-x86_64-20210603-boot.img > CHECKSUM
gpg --sign --armor CHECKSUM
The above commands generates both files CHECKSUM
and CHECKSUM.asc
.
This page has a useful guide, verify fedora images
Steps to verify:
First you need to import the keys, click in the download link, then CTRL + save.

Then import.
gpg --import RPM-GPG-KEY-CentOS-Official
Then verify that the CHECKSUM file is valid, here you need the following both files
Verify with the following commands
gpg --verify CHECKSUM.asc
[chris@f34 verify-centos]$ gpg --verify CHECKSUM.asc
gpg: assuming signed data in 'CHECKSUM'
gpg: Signature made Thu 03 Jun 2021 01:58:15 AM -05
gpg: using RSA key 05B555B38483C65D
gpg: Good signature from "CentOS (CentOS Official Signing Key) <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 99DB 70FA E1D7 CE22 7FB6 4882 05B5 55B3 8483 C65D
[chris@f34 verify-centos]$
The importan line is This
gpg: Good signature from "CentOS (CentOS Official Signing Key) <[email protected]>" [unknown]
All is ok.
Now and lastly
Verify the hash number of the Centos image file downloaded match with the hash number inside the CHECKSUM
file. Remember that the CHECKSUM
file can have inside multiple hash numbers of the different versions, in this case there are 2 versions

You can do it in multiples ways.
First way:
Run the following command.
sha256sum CentOS-Stream-8-x86_64-20210603-boot.iso
[chris@f34 verify-centos]$ sha256sum CentOS-Stream-8-x86_64-20210603-boot.iso
6d957521b4488fc44bb80bdcb618bc1cf9891a997fdbd94e22424c14a356cf09 CentOS-Stream-8-x86_64-20210603-boot.iso
[chris@f34 verify-centos]$
And compare this hash number 6d957521b4488fc44bb80bdcb618bc1cf9891a997fdbd94e22424c14a356cf09
with the one inside the CHECKSUM file in the corresponding line of the image, the hash numbers must match each other.

As you can see, the hash numbers matches.
Second way:
Run the following command.
Select the hash number inside the CHECKSUM file copy and paste there after grep
command.
sha256sum CentOS-Stream-8-x86_64-20210603-boot.iso | grep paste-here-the-hash-number

If the color is red all is ok, It means both matches.
Third way
The easiest way, both files are neccesary.
- CentOS-Stream-8-x86_64-20210603-boot.iso
- CHECKSUM
Run the follwing command
sha256sum -c CHECKSUM
[chris@f34 verify-centos]$ sha256sum -c CHECKSUM
CentOS-Stream-8-x86_64-20210603-boot.iso: OK
sha256sum: CentOS-Stream-8-x86_64-20210603-dvd1.iso: No such file or directory
CentOS-Stream-8-x86_64-20210603-dvd1.iso: FAILED open or read
sha256sum: WARNING: 1 listed file could not be read
[chris@f34 verify-centos]$
As we can see in there say ok
CentOS-Stream-8-x86_64-20210603-boot.iso: OK
End.