I could not download sha1 from here: https://github.com/keycloak/keycloak/releases/download/26.7.0/keycloak-26.7.0.tar.gz.sha1
You’re better off downloading https://github.com/keycloak/keycloak/releases/download/26.7.0/keycloak-26.7.0.tar.gz.asc and verifying the signature matches the expected key found at Keycloak Signing Keys - Keycloak . I see your point, though, that the Downloads page references the sha1 instead of the signature file. 