HyperWiki

This is an old revision of the document!

… (WIP)

This page explains how to verify their integrity and authenticity.

Download

The images can be burned to a DVD, mounted as an image, or directly written to an USB stick using an utility like dd.

It is intended for new installations only; an existing Hyperbola distribution can always be updated with:
# pacman -Syu

.

Hyperbola live image

Live image for installation and recovery.

Information about this edition
Release: Milky Way v0.4.4
Size: 1.2 GiB
Announcement: Announcement
Torrent: Torrent
Magnet: Magnet
Authenticity: Don't forget to verify your live image

Sources

See our sources page for further details.

Integrity check

To verify the integrity of your live image, generate its SHA512 sum and compare it to the one found in the sha512sum file.

In most GNU/Linux distributions the SHA512 sum can be generated by opening a terminal and running the following commands: 

$ cd
$ cd live_image
$ sha512sum -b *.iso

The last command should show you the SHA512 sum of your live file. Compare it to the sha512sum file. If it match, you've successfully verified the integrity of your live image.

If you have coreutils version 8.25 or newer, another way of checking the sum is to ask the sha512sum command to check the file against the sha512sum file, like this:
$ sha512sum -c hyperbola-milky-way-v0.3.1-dual.iso.sha512

Authenticity check

To verify the authenticity of the sha512sum file, we need to check the signature on the signed file.

Import the Hyperbola signing key: 

$ gpg --keyserver pgp.mit.edu --recv-key "C92B AA71 3B8D 53D3 CAE6 3FC9 E697 4752 F970 4456"
If gpg complains about the key ID, try the following commands instead:
$ gpg --keyserver pgp.mit.edu --recv-key F9704456
$ gpg --list-key --with-fingerprint F9704456

Check the output of the last command, to make sure the fingerprint is C92B AA71 3B8D 53D3 CAE6 3FC9 E697 4752 F970 4456.

Verify the authenticity of the sha512sum file, like this: 

$ cd
$ cd live_image
$ gpg --verify hyperbola-milky-way-v0.3.1-dual.iso.sha512.sig

The output of the last command should tell you that the file signature is 'good' and that it was signed with the following key: F9704456.

Acknowledgement

This wiki article is based on Mint's download page. We may have removed non-FSDG bits from it.