Checking in Linux

Automated checksum verification

Assuming both checksum file, signature file and iso file is in the same folder - usually your ~/Downloads folder.

The official editions use SHA-256

 $ ls -l manjaro-kde*
-rw-r--r-- 1 fh fh 5669099520 11 jun 14:17 manjaro-kde-26.0.4-260327-linux618.iso
-rw-r--r-- 1 fh fh        105 11 jun 14:14 manjaro-kde-26.0.4-260327-linux618.iso.sha256
-rw-r--r-- 1 fh fh        438 11 jun 14:17 manjaro-kde-26.0.4-260327-linux618.iso.sig

To verify the ISO checksum if the filename ends with iso.sha256

 $ sha256sum -c manjaro-kde-26.0.4-260327-linux618.iso.sha256 
manjaro-kde-26.0.4-260327-linux618.iso: OK

Or in case of a the community cinnamon edition using SHA-512

 $ ls -l manjaro-cinnamon*
-rw-r--r-- 1 fh fh 3173707776 23 jun 12:57 manjaro-cinnamon-25.0.3-minimal-250609-linux612.iso
-rw-r--r-- 1 fh fh        182 23 jun 12:57 manjaro-cinnamon-25.0.3-minimal-250609-linux612.iso.sha512
-rw-r--r-- 1 fh fh        438 23 jun 12:57 manjaro-cinnamon-25.0.3-minimal-250609-linux612.iso.sig

 $ sha512sum -c manjaro-cinnamon-25.0.3-minimal-250609-linux612.iso.sha512 
manjaro-cinnamon-25.0.3-minimal-250609-linux612.iso: OK

See the forum guide on checksum verification at https://forum.manjaro.org/t/howto-write-a-manjaro-iso-to-an-usb-stick-with-dd/1507

Manual checksum verification

You can generate a checksum manually for the ISO and then compare the result to the content of the checksum file.

To generate a SHA-256 checksum for a file

sha256sum <filename>

Example for the KDE iso mentioned above

 $ sha256sum manjaro-kde-26.0.4-260327-linux618.iso
9d9e5f6b1558a8850bf19ca21af9c71cf3810c69a77ab860130281d09f6a33b9  manjaro-kde-26.0.4-260327-linux618.iso

 $ cat manjaro-kde-26.0.4-260327-linux618.iso.sha256 
9d9e5f6b1558a8850bf19ca21af9c71cf3810c69a77ab860130281d09f6a33b9  manjaro-kde-26.0.4-260327-linux618.iso

As you can see the two outputs are identical - as they should be - and the ISO file is assumed to be complete an undamaged.

Signature verification

Official releases and community editions provided on the Manjaro website will be signed using a GPG signature.

For the kde example above

 $ gpg --verify manjaro-kde-26.0.4-260327-linux618.iso.sig 
gpg: assuming signed data in 'manjaro-kde-26.0.4-260327-linux618.iso'
gpg: Signature made fre 27 mar 2026 23:40:20 CET
gpg:                using RSA key 3B794DE6D4320FCE594F4171279E7CF5D8D56EC8
gpg: Good signature from "Manjaro Build Server <build@manjaro.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 3B79 4DE6 D432 0FCE 594F  4171 279E 7CF5 D8D5 6EC8

And the same for the cinnamon example

 $ gpg --verify manjaro-cinnamon-25.0.3-minimal-250609-linux612.iso.sig
gpg: assuming signed data in 'manjaro-cinnamon-25.0.3-minimal-250609-linux612.iso'
gpg: Signature made man 09 jun 2025 08:57:15 CEST
gpg:                using RSA key 3B794DE6D4320FCE594F4171279E7CF5D8D56EC8
gpg: Good signature from "Manjaro Build Server <build@manjaro.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 3B79 4DE6 D432 0FCE 594F  4171 279E 7CF5 D8D5 6EC8

See the forum mini-guide on signature verification at https://forum.manjaro.org/t/root-tip-how-to-forum-mini-guide-to-verify-iso-signature/146680