How to verify your Ubuntu download

rogerioleirofontan · 2020-04-14T10:55:30.954Z

The “| grep OK” part seems to make things not work on Portuguese, since in portuguese when the ISO is OK, the command actually display the word SUCESSO (which means sucess). This problem may happen in other languages too.

Maybe the tutorial should put the command only as:

sha256sum -c SHA256SUMS 2>&1

tegridy · 2020-06-24T22:15:55.818Z

I have found 1 main issue with this guide. Because of this I was not able to verify my ISO using this guide. I had to google for help.
This command did not work for me:
gpg --keyid-format long --keyserver hkp://keyserver.ubuntu.com --recv-keys 0x46181433FBB75451 0xD94AA3F0EFE21092
I had to put number “80” after address like this:
gpg --keyid-format long --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 0x46181433FBB75451 0xD94AA3F0EFE21092
For Linux beginners like me it was big deal with lot of cursing till I found what’s wrong. But I understand Linux is free open source software. I just trying to help improve this guide to save other beginners.

There is also one confusing thing:
By following step " If you don’t have the keys…" I did not get this:
gpg: Signature made Thu Apr 5 22:19:36 2018 EDT using DSA key ID 46181433FBB75451 gpg: Can't check signature: No public key gpg: Signature made Thu Apr 5 22:19:36 2018 EDT using RSA key ID D94AA3F0EFE21092 gpg: Can't check signature: No public key

But instead I just got one of the two keys (second one).
I hope the guide will be repaired. My OS from which I followed the guide: “Linux Mint 19.3”

empleat · 2021-01-07T18:25:20.740Z

md5sum --version
sha256sum --version

These commands do nothing. I am on Windows. Installed gpg4win. So i have gpg.

Also tested on Linux.

I get message:

gpg: Note: '--version' is not considered an option
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
usage: gpg [options] [filename]

I tried:

gpg md5sum --version

Or launch gpg and then write:

md5sum --version

Facing same problem using:

sha256sum --version

I ran that as root in Linux and as admin in Windows!

Also didn’t find anything about these commands even on gpg4win and google found nothing! Strange!

zylstra · 2021-01-11T07:58:00.334Z

Change suggestion:
http://releases.ubuntu.com/bionic/ -> http://releases.ubuntu.com/focal/

saivinob · 2021-04-09T05:58:56.043Z

system:

for the current version of Ubuntu

Or to avoid having to change URL each release, we could simply change ‘current’ to ‘18.04 (Bionic Beaver)’.

for the 18.04 (Bionic Beaver) version of Ubuntu

ian-weisser · 2021-04-25T12:24:29.029Z

A post was split to a new topic: Is Ubuntu vulnerable to fake keys?

michelle-ob · 2021-06-25T09:09:24.589Z

Hi, I downloaded Ubuntu Studio 21.04 Live DVD & it won’t boot. I ran the checksum, and it won’t verify the download. Tried a few times. The instructions for verification need a section on how to notify Ubuntu (or derivatives) if the checksum & the iso are corrupted or invalid.

ian-weisser · 2021-06-29T00:23:14.230Z

michelle-ob:

need a section on how to notify Ubuntu

You seem to be stuck, which is what the “Finding Help” section of the tutorial is for.

steventillson02 · 2021-07-06T13:55:44.518Z

empleat:

md5sum --version
sha256sum --version

md5sum --version
sha256sum --version

masteryeetus37 · 2021-07-20T00:09:38.971Z

In Windows Powershell (all versions), you can use Get-FileHash to get the hashes.

pbhj · 2022-01-01T15:18:17.027Z

Would be useful to be able to see the whole tutorial on one page as it’s displayed here!

madhens · 2022-02-03T00:35:26.786Z

Thanks for joining the community! I’ll bring this up during our next talk with the design team, if there would be a way to have a single-page option for tutorials. Is it this tutorial only, or are there others that you also think are useful to have in a single-page version?

hoiho · 2022-04-27T10:49:05.171Z

New to this whole thing. I just followed the instructions to verify my 2022.04 download and when I clicked on the SHA256SUMS link it took me to a page with the sums as text. I copied the text to a document, saved it as SHA256SUMS and used that, but it gave me a Bad signature. I went back and right clicked the SHA256Sums link and used the Save link as… option which gave me a Good signature. Is it worth adding a comment like “Do not copy their content, use “right-click->Save Link As…” to download the files themselves”?

Quote lifted from the Mint forums

https://linuxmint-guides.linuxsecrets.com/en/latest/verify.html

I use Mint, so I checked there. As one other Mint using commenter mentions above, I only got one key (RSA). Perhaps not so significant???

tomreyn · 2023-03-05T23:21:29.055Z

Three suggestions for improvement:

md5sum should no longer be used. Ubuntu no longer provides md5sums for releases.

The DSA-1 key

46181433FBB75451

should be no longer in use, because DSA-1 is considered weak for several years now. Please ensure any currently used keys are listed. If possible, add a note on where users can check for them in case of future changes.

While the “long” key ID format is being used here, this is no longer sufficient to uniquely identify a GPG key. Please use the full key fingerprint when referring to keys. Also, transfer of the key material should ideally take place over a transport encrypted connection (HKPS) when trust is to be bestowed / inherited.

For example,

gpg --keyid-format long --keyserver hkp://keyserver.ubuntu.com --recv-keys 0x46181433FBB75451 0xD94AA3F0EFE21092

should actually say

gpg --keyid-format long --keyserver hkps://keyserver.ubuntu.com --recv-keys 0xC5986B4F1257FFA86632CBA746181433FBB75451 0x843938DF228D22F7B3742BC0D94AA3F0EFE21092

somewhat_anonymous · 2023-05-02T06:09:42.984Z

Could you please provide alternate steps to obtain the public GPG keys which don’t rely on “hkp://”? My organisation’s proxy only allows me http/https access to the internet.

The specific command I need to work around is:
gpg --keyid-format long --keyserver hkp://keyserver.ubuntu.com --recv-keys 0x46181433FBB75451 0xD94AA3F0EFE21092

Thank you!

mikael-monnier · 2023-12-26T14:16:48.545Z

The following check command ( visible on https://ubuntu.com/tutorials/how-to-verify-ubuntu#6-check-the-iso ) Must be change :
sha256sum -c SHA256SUMS 2>&1 | grep OK

SINCE the PATTERN “OK” appear only in ENGLISH TERMINAL.
Keep only the minimum command length for portability
KISS: Keep it Simple and Stupid

sha256sum -c SHA256SUMS

You may wonder how many users gave up at this stage, for this kind of silly reason…

jboucher37 · 2024-04-15T00:05:49.569Z

somewhat_anonymous:

FYI, until I removed the –keyid-format long option from all the gpg commands in this article, the –verify kept giving me the error:
$ gpg: BAD signature from “Ubuntu CD Image Automatic Signing Key (2012) cdimage@ubuntu.com” [unknown]
After re-running all previous commands without that option, I ran:
$ gpg --verify SHA256SUMS.gpg SHA256SUMS
and got:
gpg: Good signature from “Ubuntu CD Image Automatic Signing Key (2012) cdimage@ubuntu.com” [unknown]

oracularhades · 2024-06-14T07:24:07.300Z

Hello! “sha256sum” isn’t on MacOS builds by default, but there is shasum -a 256. If you run sha256sum -c SHA256SUMS 2>&1 | grep OK it will always return an empty response,

If you get no results (or any result other than that shown above) then the ISO file does not match the checksum. This could be because the ISO has been altered, or it downloaded incorrectly - either way you should download a fresh ISO from a known good source.

leading the user (including me) to thinking the iso is invalid. I assume this hasn’t been picked up before because not a ton of people verify their ISOs, even though they should. https://ubuntu.com/tutorials/how-to-verify-ubuntu#6-check-the-iso

utkb · 2024-06-22T09:57:21.266Z

sha256sum -c SHA256SUMS 2>&1 | grep OK

This command give no output if the system locale is not English!

ielund · 2024-08-16T16:50:57.649Z

I just thought I’d mention that I got no results when checking my iso but the file apparently worked fine nonetheless. I downloaded it a second time and checked it again before creating the startup disk but still got no result. Eventually on the advice of a fellow community member from a local forum, I decided to assume the file was okay and proceed. Everything seems to have worked well. I still don’t know why I didn’t get the “OK”, though.

This was on Ubuntu. I am just noticing right now that someone mentioned the command sha256sum -c SHA256SUMS 2>&1 | grep OK will always return an empty response on MacOS. Maybe it was the same problem for me, or a similar one.