Verify Downloads

Start from an official release

Begin at the official Nulx Linux Releases repository linked from the Download page. It will hold the release notes and verification files. R2 at downloads.nulxlinux.com is the planned ISO host, not an active approved channel.

No public ISO, approved release key or signing fingerprint is published yet. Do not use an issue attachment, unofficial mirror or placeholder filename as a release.

Check the signed manifest first

When a release exists, confirm the signing-key fingerprint through the official website and release repository. Verify the manifest signature using that key, then follow only the exact ISO URL recorded in the manifest. The hostname alone is not proof of authenticity.

Calculate the checksum

Replace <version> with the version in the release notes. Compare the complete SHA-256 and byte size with the signed manifest.

sha256sum Nulx-Linux-<version>-amd64.iso

Get-FileHash .\Nulx-Linux-<version>-amd64.iso -Algorithm SHA256

Verify the ISO signature

Follow the release-specific signature command and use the same approved key. A matching hash detects a changed file, but does not by itself authenticate its publisher.

If the URL, filename, version, size, hash or signature differs, stop. Do not boot the file. Report a suspected integrity problem privately.