Ceph

We take security seriously

Once you have downloaded a file, be sure to verify it for both security and integrity.

By calculating the file’s checksum on your own computer and comparing it to the original checksum, you can verify the file has not been tampered with or corrupted. When the project provides signed checksums, verify their signature using the project's published signing key and instructions.

1. Download the checksum file for your exact Ceph download from the project's release source.

2. If signed checksums are provided, obtain the project's signing key and confirm its fingerprint using the project's documentation.

3. Follow the project's verification instructions to validate the checksum file's signature before trusting its contents.

4. For a SHA-256 checksum file supported by sha256sum, run the following in the directory containing your downloaded file. Replace CHECKSUM_FILE with the actual checksum filename.

   sha256sum -c CHECKSUM_FILE

Continue only when verification succeeds. If a checksum or signature fails, download the file again and verify it before installing.