I will go through the whole process for CentOS-7 and then explain the slight differences for other versions of CentOS. The provided file is signed with the same key that the specific distribution uses for it's signed packages. This procedure is a bit more complicated and we will go thru how to verify all parts of the process here. If you can't find the specific release announcement for the ISO you have downloaded, the directory from which the ISO came will have a file that you can use to verify the ISO.

This is by far the easiest way to verify the ISOs, so PLEASE look at the Release Notes or Release Announcement for the ISOs or Images to find the sha256sums. This tip tells you how to compare your downloaded ISO's sha256sum to the value from the Release Notes page on many different operating systems. If you visit the Release Notes page, you will see, on an https page controlled by the sha256sum values for specific ISO name. We provide several mechanisms to verify that packages and ISOs on those mirrors are unmodified.Īny page where you can download a CentOS ISO or Cloud image also has a Release Notes link. The CentOS Project has many donated mirrors (not controlled directly by the project) where you can download ISOs and updated packages. How CentOS Linux Makes Verification Possible

Repositories Where Signed metadata is Provided.

What is Signed Metadata for Repositories.

Using signed CentOS-6 or CentOS-7 Metadata for Repositories Released by the CentOS Project.

Download the ISO (or Image) file and the files to validate

How CentOS Linux Makes Verification Possible.

How to Verify you are Getting CentOS Linux Images, ISOs, or Packages.

Centos 7 iso