# Verify downloaded debian ISO integrity
Procedure to verify authenticity of downloaded Debian ISO image
## Table of Contents
- [Verify downloaded debian ISO integrity](#verify-downloaded-debian-iso-integrity)
- [Table of Contents](#table-of-contents)
- [Download debian and checksums](#download-debian-and-checksums)
- [Verify checksum](#verify-checksum)
- [Verify authenticity of checksums](#verify-authenticity-of-checksums)
- [The list of public keys to download](#the-list-of-public-keys-to-download)
- [Download public key(s) used to sign cheksums](#download-public-keys-used-to-sign-cheksums)
- [Verify signature of the checksum file](#verify-signature-of-the-checksum-file)
- [Check the CD-ROM integrity](#check-the-cd-rom-integrity)
- [Reference](#reference)
## Download debian and checksums
Download debian ISO including checksums for that ISO:
Netinst ISO:
[Debian ISO CD's](https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/)
Live ISO:
[Debian ISO hybrid CD's](https://cdimage.debian.org/debian-cd/current-live/amd64/iso-hybrid/)
## Verify checksum
Verify checksum of the ISO image is the same as the one in checksums file
```bash
sha512sum -c SHA512SUMS --ignore-missing
```
## Verify authenticity of checksums
Verify the authenticity of the checksum files against public key used to sign the checksum
### The list of public keys to download
On the link below are key ID's, ex: `pub rsa4096/988021A964E6EA7D` and `rsa4096/DA87E80D6294BE9B`
[Verifying authenticity of Debian images](https://www.debian.org/CD/verify)
### Download public key(s) used to sign cheksums
Repeat download for each key that might be relevant
```bash
gpg --keyserver keyring.debian.org --recv 988021A964E6EA7D
gpg --keyserver keyring.debian.org --recv DA87E80D6294BE9B
```
### Verify signature of the checksum file
```bash
gpg --verify SHA512SUMS.sign
```
If you get an error such as:
`gpg: BAD signature from "Debian CD signing key <[email protected]>"`</br>
then this means you need to download checksum files not by copy\pasting their values into text
editor but rather download checksum files themself!
## Check the CD-ROM integrity
Once the installation media is booted from, use option which says `Check the CD-ROM integrity`