There are two possible stages of verification:

• File verification: verify the downloaded image before flashing to ensure you have the correct untampered file
• Boot verification: verify the installed build on the device after installing, possible at each boot

File verification

Currently, factory images from version 7.0.0.0 onwards are verified using SHA256 checksums only.

SHA256 checksums

SHA256 checksums are available for all factory images and over-the-air (OTA) full and incremental updates. You can append .sha256sum to any download URL to retrieve the checksum directly, e.g. https://release.calyxos.org/factory/tegu/16/tegu-factory-260720100.zip.sha256sum

Download the factory image from Get CalyxOS, then run the appropriate command below and confirm the hash matches what’s shown on the device’s install page.

Linux

sha256sum tegu-factory-260720100.zip
# tegu is Pixel 9a, replace with your device

Expected output:

7c2e92d76f09ce953df6b059f652c96e10e783513a32a8d93fd3eb7cb9e2b24b  tegu-factory-260720100.zip

macOS

shasum -a 256 tegu-factory-260720100.zip
# tegu is Pixel 9a, replace with your device

Expected output:

7c2e92d76f09ce953df6b059f652c96e10e783513a32a8d93fd3eb7cb9e2b24b  tegu-factory-260720100.zip

Windows

certUtil -hashfile tegu-factory-260720100.zip SHA256
# tegu is Pixel 9a, replace with your device

Expected output:

SHA256 hash of tegu-factory-260720100.zip:
7c2e92d76f09ce953df6b059f652c96e10e783513a32a8d93fd3eb7cb9e2b24b
CertUtil: -hashfile command completed successfully.

Boot verification

After flashing CalyxOS, you can verify the installed build on the device using the Android Verified Boot (AVB) fingerprint, which is displayed on screen during each power on. Confirm the fingerprint shown matches the expected value for your device in the table below.

Verifying archive images

Factory images before version 6.10.20 can be verified with minisign, GPG, and SHA256 checksums.

Minisign

Factory images from July 2021 - July 2025 are signed using minisign.

Install minisign:

• Linux:
  • Arch Linux: sudo pacman -S minisign
  • Fedora: sudo dnf install minisign
  • Ubuntu: sudo add-apt-repository ppa:savoury1/minisign && sudo apt update && sudo apt install minisign
  • Debian: sudo apt install minisign
  • Others: See https://github.com/jedisct1/minisign#compilation--installation
• macOS:
  • Official binary: https://github.com/jedisct1/minisign/releases/download/0.11/minisign-0.11-macos.zip
  • Homebrew: brew install minisign
• Windows:
  • Official binary: https://github.com/jedisct1/minisign/releases/download/0.11/minisign-0.11-win64.zip
  • Chocolatey: choco install minisign
  • Scoop: scoop install minisign

Verify:

1. Download the factory image and signature files from our image archive
2. Download the public key: minisign.pub
3. Place all 3 files in the same folder and run:

minisign -Vm akita-factory-24509000.zip -p minisign.pub
# akita is Pixel 8a, replace with your device

Expected output (comment may differ per release):

Signature and comment signature verified
Trusted comment: CalyxOS 5.9.0 - July 2024 Security update

GPG (additional verification)

The minisign public key has also been GPG-signed by Nicholas Merrill.

• OpenPGP Fingerprint: BC2C B9C4 993C 086F FDAD 8D20 5905 C9C7 4693 488B

1. Download the public key: minisign.pub
2. Download the signature: minisign.pub.sig
3. Place both files in the same folder and run:

gpg --keyserver keys.openpgp.org --recv-keys BC2CB9C4993C086FFDAD8D205905C9C74693488B
gpg --verify minisign.pub.sig minisign.pub

Expected output:

gpg: Signature made Sat 10 Jul 2021 05:15:55 AM IST
gpg:                using RSA key BC2CB9C4993C086FFDAD8D205905C9C74693488B
gpg: checking the trustdb
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   2  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 2u
gpg: Good signature from "Nicholas Merrill <nick@calyx.com>" [unknown]
gpg:                 aka "Nicholas Merrill <nick@calyx.net>" [unknown]
gpg:                 aka "Nicholas Merrill <nick@calyxinstitute.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: BC2C B9C4 993C 086F FDAD  8D20 5905 C9C7 4693 488B

SHA256 checksums

SHA256 checksums are also available for all older builds. See the instructions above; the process is the same.

Mirrors

The minisign signatures and SHA256 checksums are all also stored in a git repository mirrored to multiple places:

1. https://gitlab.com/CalyxOS/releases
2. https://github.com/CalyxOS/releases

Hint: You can press t on these pages to quick-jump to a filename (e.g. tegu-factory-260720100.zip, akita-factory-24509000).