Downloads & builds

How do I check my download hasn’t been corrupted?

What it means: Both the image and the tarball ship alongside a SHA256SUMS file, so you can confirm what you downloaded matches exactly what was published before you write it anywhere or run it.

Fix: From the folder holding both files:

sha256sum -c SHA256SUMS

A clean download prints OK next to the matching filename.

If that didn’t work: If the check fails, don’t use the file — re-download both it and its SHA256SUMS file rather than assuming it’s a false alarm.

How do I build the artifacts myself instead of downloading them?

What it means: Both distributable forms — the tarball and the ready-made card image — are built by scripts you can run yourself from a source checkout, rather than only ever downloading a published build.

Fix:

Tarball:

make tarball          # or: make dist-tarball, for the tarball plus its SHA256SUMS

Image:
Terminal window
```
make raspi-base        # downloads and checksum-verifies the official base image
make image              # customises that base image in place, in a privileged container
```
This has to run on a Linux host or CI runner (or a Podman machine on other platforms) — it needs privileged, loop-mount access a normal local check shouldn’t require, so it’s kept separate from the regular local checks.

If that didn’t work: The image build is the pickier of the two — if it fails, the most common cause is the container tool not being allowed to run in privileged mode on your host; confirm that before anything else.