Which CLI command verifies the authenticity and integrity of a downloaded ISO?

Question

Options

• AOpenssl dgst -sha512 -keyform der -verify <public key.der> -signature <ISO image.iso.signature>
• BOpenssl dst -sha256 -keyform der -verify <public key.der> -signature <ISO image.iso.signature>
• COpenssl dst -sha512 -keyform der -verify <public key.der> -signature <ISO image.iso.signature>
• DOpenssl dgst -sha256 -keyform der -verify <public key.der> -signature <ISO image.iso.signature>

• A
  3% (2)
• B
  5% (3)
• C
  2% (1)
• D
  91% (60)

Explanation

Option D is correct because it uses the proper OpenSSL subcommand dgst (short for "digest") combined with -sha256, which is the standard hashing algorithm used by most Linux distributions (Ubuntu, Fedora, etc.) for ISO signature verification.

Why the distractors fail:

• B and C both use dst - this is simply a misspelling of dgst and will result in an "unknown option" error; OpenSSL has no dst subcommand.
• A uses the correct dgst subcommand but pairs it with -sha512. While SHA-512 is cryptographically valid, the vast majority of Linux ISO release signatures use SHA-256, making this the wrong choice in standard practice.

Memory tip: Think "Digest = Dgst" - the subcommand is an abbreviation of the full word "digest," so it must contain the g. If you see dst in an answer, eliminate it immediately. Between SHA-256 and SHA-512, remember that 256 is the default for modern ISO verification workflows.

No community discussion yet for this question.