Verify the download

Two checks. The checksum shows the file arrived whole. The signature shows the checksums come from us.

Put these in one folder: the .iso, SHA256SUMS and SHA256SUMS.sig from the Download page, and allowed_signers.

1. The checksum

Linux:

sha256sum -c --ignore-missing SHA256SUMS

macOS:

shasum -a 256 -c --ignore-missing SHA256SUMS

Both should print omaboot-live-<version>.iso: OK. On Windows, run Get-FileHash omaboot-live-<version>.iso in PowerShell and compare the hash with the line in SHA256SUMS.

2. The signature

ssh-keygen -Y verify -f allowed_signers -I omaboot -n omaboot-release -s SHA256SUMS.sig < SHA256SUMS

It should print:

Good "omaboot-release" signature for omaboot with ED25519 key SHA256:fxYQ+c2xarev6b0gcboKkWoqa6aRm+OvNS5EugFy2wg

Anything else: don't use the image.

ssh-keygen comes with macOS and Linux (OpenSSH 8.1 or newer). On Windows, run it in WSL or Git Bash.

The keys

allowed_signers lists two keys. Their fingerprints:

• Release key. Signs every release; each signature needs the maintainer's approval.

  SHA256:fxYQ+c2xarev6b0gcboKkWoqa6aRm+OvNS5EugFy2wg

• Backup key. Kept offline, on paper. It signs only a release that ships a new key list, if the release key is ever lost or compromised.

  SHA256:B7XiNgw31ngaI/ncSz4bTA7BFCu478XfoQeEz2o+qjw

The same keys are in the image's build repository, so you can compare them with a second source.

Why you can trust it

• Built in public. Each release is built by GitHub Actions from a tagged commit of the public image repository: Omarchy's own ISO build at a named upstream commit, plus our changes as a short series of readable commits. Every release links its build log.
• The official packages. The build pins every package to the versions of the official Omarchy ISO of the same release, from the Arch Linux Archive, Omarchy's stable channel and t2linux. pacman checks each package's signature as it installs it.
• A difference report. Each release compares its packages with the official ISO and lists every file that differs, each one explained.
• Little of our own. The only binaries we build ourselves are the tester and a few patched kernel modules. Their build log shows that rebuilding them without our patches gives the official modules.
• The key stays off the build machine. The build never sees the signing key. The maintainer checks the build, then signs the checksums on their own computer.

Read the source code (published on GitHub with the first release).