Images are signed with a detached GPG signature (.asc) signed by my personal key 0x090EF0DB.
Get the key and verify like this: I made good progress.
Kernel and Busybox might work with older version as well, but i did not test.
You cannot compile U-Boot with anything newer than 4.8. What version of the gcc-arm-linux-gnueabihf toolchain is that?
Q4OS (PINE A64( )) 2.4-r1 [Nov 10] | Volumio (ROCK64) 2.299 [Oct 30] | Q4OS (Pinebook) 2.4-r1 [Oct 30] | Diet Pi (ROCK64) v156 [Oct 24] | Armbian - Xenial Desktop (Pinebook) 5.34 [Oct 24] | motion Eye OS (PINE A64( )) 20171003 [Oct 23] | Android Images (ROCK64) 20171012 [Oct 23] | Bliss OS (Pinebook) 20170919 [Oct 13] | Bliss OS (PINE A64( )) 20170919 [Oct 13] Getting Started | Visit the WIKI | IRC Logs | Forum Rules/Policy To make clear what Allwinner did to U-Boot I started a Git repository forked from mainline.
See https://github.com/longsleep/u-boot-pine64 Branch pine64-hacks has applied the BSP changes on top of mainline 2014.07 tag and contains various required backports and fixes for Pine64 on top.
Get the key and verify that the download is intact and unmodified. If you want to have a adventure, see https://github.com/longsleep/build-pine64-image and build U-Boot, ATF, Kernel and Initrd yourself.