Verify the download · CouchPotatOS docs

Check that the CouchPotatOS installer you downloaded is complete and signed by us.

Every CouchPotatOS build is signed on the openSUSE Build Service. Checking the signature proves your download is complete and comes from us. The installer does this check by itself for the system it downloads, so this step is only for the installer ISO.

You need two small files next to the ISO: the checksum and its signature. Both are linked on the download page.

On Linux or macOS

# 1. Import our signing key (once)
curl -sL 'https://build.opensuse.org/projects/home:zs-ko/signing_keys/download?kind=gpg' | gpg --import

# 2. Check that the checksum file is signed by that key
gpg --verify CouchPotatOS-Installer.x86_64.iso.sha256.asc CouchPotatOS-Installer.x86_64.iso.sha256

# 3. Check the ISO against the checksum
sha256sum -c CouchPotatOS-Installer.x86_64.iso.sha256

Step 2 should say Good signature from “home:zs-ko OBS Project”, with this fingerprint:

8530 9B1B 0867 DCC9 7F3F  2828 F3F6 317F E074 92A7

Step 3 should say OK. On macOS, use shasum -a 256 -c in place of sha256sum -c.

On Windows

In PowerShell, in the folder with the download:

(Get-FileHash .\CouchPotatOS-Installer.x86_64.iso).Hash
Get-Content .\CouchPotatOS-Installer.x86_64.iso.sha256

The two long numbers must match (letter case doesn’t matter). To check the signature too, install Gpg4win and follow the Linux steps.