From: David Uhden Collado <daviduhden@gmail.com>
Subject: faq4.html: SHA-256 verification and USB flashing on Windows
To: tech@openbsd.org
Date: Fri, 24 Oct 2025 22:14:33 +0200

Hello everyone,

I have attached to this email is a patch that updates faq4.html. It adds 
native Windows steps for calculating and comparing SHA-256 using the 
Command Prompt and PowerShell. It also adds a brief guide for creating 
an installation medium with a USB flash drive using Rufus.

Best regards,
David.
Index: faq/faq4.html
===================================================================
RCS file: /cvs/www/faq/faq4.html,v
diff -u -r1.562 faq4.html
--- faq/faq4.html	22 Oct 2025 01:27:44 -0000	1.562
+++ faq/faq4.html	24 Oct 2025 19:42:41 -0000
@@ -285,12 +285,47 @@
 Directory does not contain SHA256.sig. Continue without verification? [no]
 </pre>
 
+<p>
 This is because it would make no sense for the installer to verify them.
 If someone were to make a rogue installation image, they could certainly
 change the installer to say the files were legitimate.
 If the image's signature has been verified beforehand, it is safe to answer
 "yes" at that prompt.
 
+<p>
+Windows includes built-in tools to compute SHA-256 hashes.
+These steps let you confirm your downloaded files match 
+the official checksum:
+
+<ol>
+  <li>Open a Command Prompt or PowerShell in the folder containing 
+    the installation files.
+  <li>Compute the hash of the image with one of the following:
+    <ul>
+      <li>Command Prompt:
+        <pre class="cmdbox">
+          <b>CertUtil -hashfile install*.img SHA256</b>
+        </pre>
+      <li>PowerShell:
+        <pre class="cmdbox">
+          <b>Get-FileHash install*.img -Algorithm SHA256</b>
+        </pre>
+    </ul>
+  <li>Display the expected hash for that file from the
+     <code>SHA256</code> file and compare.
+    <ul>
+      <li>Command Prompt:
+        <pre class="cmdbox">
+          <b>findstr /I "install*.img" SHA256</b>
+        </pre>
+      <li>PowerShell:
+        <pre class="cmdbox">
+          <b>Select-String -Path SHA256 -Pattern 'install*.img'</b>
+        </pre>
+    </ul>
+</ol>
+
+<p>
 <h2 id="MkInsMedia">Creating Install Media</h2>
 
 <h3 id="MkFlash">Flash Drives</h3>
@@ -310,9 +345,25 @@
 
 <p>
 Details of this will vary on other platforms.
-If you're using a different OS, be sure to select the appropriate device
-name: <code>/dev/sdX</code> on Linux or <code>/dev/rdiskX</code> on macOS
-for example.
+If you're using a different Unix-like OS, be sure to select the
+appropriate device name: <code>/dev/sdX</code> on Linux or
+<code>/dev/rdiskX</code> on macOS for example.
+
+<p>
+If you are on Windows, you can create the USB installer with the 
+Rufus utility:
+
+<ol>
+  <li>Download the latest <a href="https://rufus.ie/">Rufus</a> binary
+  and run it. Installation is not required.
+  <li>In Rufus, select your USB device under <i>Device</i>. 
+    Click <i>SELECT</i> and choose the <code>install*.img</code> 
+    file you downloaded.
+  <li>Leave the other options at their defaults.
+      When prompted for a write mode, choose <b>DD image mode</b>.
+  <li>Click <i>START</i> and wait until the status bar 
+    says <i>READY</i>.
+</ol>
 
 <h3 id="MkCD-ROM">CD-ROMs</h3>
 
@@ -659,8 +710,8 @@
 file <code>openbsd.pbr</code> to your Windows system partition.
 
 <p>
-Once OpenBSD's PBR is copied to the Windows system partition, you need a shell
-with administrative privileges to run the following commands:
+Once OpenBSD's PBR is copied to the Windows system partition, you need a
+Command Prompt with administrative privileges to run the following commands:
 
 <pre class="cmdbox">
 C:\Windows\system32> <b>bcdedit /create /d "OpenBSD/i386" /application bootsector</b>