Checking in Windows

Checksum verification

For Windows 10 and newer you can use the certutil commandline tool.

Open a powershell prompt in the same folder as the downloaded files (usually C:\Users\<username>\Downloads) and execute

Generate a sha256 sum for the ISO

PS C:\Users\dev\Downloads> certutil -hashfile .\manjaro-kde-26.0.4-260327-linux618.iso sha256
SHA256 hash of .\manjaro-kde-26.0.4-260327-linux618.iso:
9d9e5f6b1558a8850bf19ca21af9c71cf3810c69a77ab860130281d09f6a33b9
CertUtil: -hashfile command completed successfully.

List the content of the checksum file

PS C:\Users\dev\Downloads> cat .\manjaro-kde-26.0.4-260327-linux618.iso.sha256
9d9e5f6b1558a8850bf19ca21af9c71cf3810c69a77ab860130281d09f6a33b9  manjaro-kde-26.0.4-260327-linux618.iso

As you can see the hashes are identical - and the file is considered complete and undamaged.

Signature verification

There is no tool for verifying a GPG signature, so you need to download and install the gpg4win application from https://www.gpg4win.org

  1. Open Kleopatra application
  2. Enter Settings -> Configure Kleopatra menu
  3. Click the Use OpenPGP keyserver and enter the following server hkp://keys.gnupg.net
  4. Click OK
  5. Then click the Lookup on Server button
  6. Enter build@manjaro.org in the box and click Search
  7. When the list has populated, click Select All and then click Import
  8. When import is done, click the button Decrypt/Verify
  9. Navigate to your Downloads folder and open the manjaro-kde-26.0.4-260327-linux618.iso.sig file

The app will process the file and verify the signature.

Don't worry about to much about the warning message, the important detail is the phrase The signature is valid.... showing you the ISO is signed with the expected signature.