Download and verify the ISO
indiga is distributed as an x86_64 live ISO: it boots into an indiga session, where you try the system, then install it from that session.
Download
SHA-256 checksum
818e9fef9a3d4a502a12bb9e7efb797d0fba60989e1106f0fd052dc796bb65f0
Verify
Download both files into the same folder, then run:
sha256sum -c indiga-x86_64.iso.sha256
Expected result: indiga-x86_64.iso: OK (or the translated word under a
non-English locale).
Or, without the checksum file, with the checksum shown on this page:
echo "818e9fef9a3d4a502a12bb9e7efb797d0fba60989e1106f0fd052dc796bb65f0 indiga-x86_64.iso" | sha256sum -c
For a few seconds after a new ISO is published, the checksum online may still be the previous one. The verification then fails: it never accepts a file wrongly. Reload the page and download the checksum again.
The checksum is not a signature: the ISO itself is not signed. It tells you that the file arrived intact, not who built it.
The image inside the ISO
The ISO carries an indiga image, which it installs. Its digest can be read without
downloading the ISO, in the x-amz-meta-image-digest header of the
response to:
curl -sI <address of the ISO link above>
Next: try it in a virtual machine.