#Verify ubuntu download iso

Meaning - the downloaded file is legitimate and hasn't altered or tampered. If the checksum values are matched, you will see the 'OK' message. To do so, simply run: $ sha256sum -c SHA256SUMS 2>&1 | grep OK

#Verify ubuntu download iso

Next, let us go ahead and check the downloaded ISO file matches the checksum. If you see 'Good signature' in the output,the checksum file is created by Ubuntu developer and signed by the owner of the key file. Gpg: Good signature from 'Ubuntu CD Image Automatic Signing Key (2012) ' Gpg: Signature made Friday 15 February 2019 04:23:33 AM IST Gpg: There is no indication that the signature belongs to the owner. Gpg: WARNING: This key is not certified with a trusted signature!

Gpg: Good signature from 'Ubuntu CD Image Automatic Signing Key ' Sample output: gpg: Signature made Friday 15 February 2019 04:23:33 AM IST Next verify the checksum file using the signature with command: $ gpg -keyid-format long -verify SHA256SUMS.gpg SHA256SUMS Gpg: key 46181433FBB75451: public key 'Ubuntu CD Image Automatic Signing Key ' imported Gpg: key 46181433FBB75451: 105 signatures not checked due to missing keys

Gpg: key D94AA3F0EFE21092: public key 'Ubuntu CD Image Automatic Signing Key (2012) ' imported Sample output: gpg: key D94AA3F0EFE21092: 57 signatures not checked due to missing keys Now, download the correct signature key using command: $ gpg -keyid-format long -keyserver hkp:// -recv-keys 0x46181433FBB75451 0xD94AA3F0EFE21092

SHA256SUMS SHA256SUMS.gpg ubuntu-18.04.2-live-server-amd64.isoĪs you see in the above output, I have downloaded Ubuntu 18.04.2 LTS server image along with checksum and signature values. We use this signature file to verify the checksum file in subsequent steps.ĭownload the Ubuntu ISO images and these two files and put them all in a directory, for example ISO. Here, the SHA256SUMS file contains checksums for all the available images and the SHA256SUMS.gpg file is the GnuPG signature for that file.