Sign up ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

I'm trying to securely validate the hash of a downloaded ubuntu-11.04-alternate-amd64.iso but it seems I just can't find any.

I found this site:
but there are only MD5SUMs on it.

About MD5's security:

Where are the SHA256 hashes of Ubuntu images? is not a solution, because it's not using valid HTTPS.

Verifying the SHA256SUMS with GPG isn't the solution either, because not everyone has the public key, so we have to import it with:

gpg --keyserver hkp:// --recv-keys 0xFBB75451

and I think using this method could be compromised (when importing the keys).

share|improve this question
Let's go back to Q+A business. This is valid question and not a dupe (keep in mind, all close votes automatically expire after two days, so the current three shouldn't hurt). –  htorque May 28 '11 at 16:42
Actually, that page is not community editable. –  psusi May 29 '11 at 3:11
@psusi Thanks, corrected. –  htorque May 30 '11 at 8:41

3 Answers 3

up vote 6 down vote accepted

Currently only MD5 hashes are securely available. If you believe it is necessary to provide SHA256 hashes as well, please file a bug against the Ubuntu website.

Your report will be significantly more well received if you refrain from shouting profanities at those from whom you are seeking help.

share|improve this answer

Please use the GPG web-of-trust to verify key validity after importing the key.

share|improve this answer

Ubuntu help: Installation/MinimalCD, section 64-bit PC (amd64, x86_64)

share|improve this answer
This page does not provide SHA256 hashes, does not describe the normal Ubuntu releases, and is not secure because it is publicly editable. –  ændrük May 29 '11 at 21:05
thx 4 pointing that one out :\ –  LanceBaynes May 30 '11 at 3:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.