Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

where can I find PGP signatures and signing keys for Ubuntu? I want to verify the download, but the only thing I can find are the MD5 hashes (

I can't imagine that Ubuntu doesn't offer a way to check the integrity of an ISO image.

share|improve this question

marked as duplicate by bodhi.zazen, karel, Eric Carvalho, Florian Diesch, Warren Hill Jul 1 '14 at 7:55

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

There are MD5, SHA and SHA256 SUMS, gpg files, and ISO images here

share|improve this answer
Thanks. Am I supposed to use the .pgp file to verify the ISO or the Checksum data? Not sure right now. How exactly do I use the MD5SUMS.gpg/SHA1.gpg to verify the image/Checksums? I tried to create a text file and save it as a .sig, but when I verify it using GPG4Win it says "Invalid signature". Also, where do I find the signing key? – user295031 Jun 19 '14 at 17:39
See the link I gave you , this is a duplicate question. – bodhi.zazen Jun 19 '14 at 17:47
I don't think this is a solution for me as I am using GPG4Win on Windows 7. – user295031 Jun 19 '14 at 17:49
Hum, it seems you have to learn how to use your software... Once done get the key id out of the .gpg file (should be FBB75451), then get this key from, check the SHA256SUM file you have is unaltered with your gpg software, then use that sum to check the iso. – exore Jun 19 '14 at 18:05
First time I'm having major problems using GPG4Win. Verifying e.g. Tails wasn't a problem at all, because they offered a PGP signature and the signing key on their website. Could you explain, what exactly is inside this specific PGP encrypted signature and what signatures contain in general? Do they contain encrypted hashes that - together with the signing key - are used to check if the encrypted signature's and the ISO's hashes match? This would at least make sense to me. – user295031 Jun 19 '14 at 21:04
up vote 0 down vote accepted

I finally solved what was causing these problems:

After I figured out I had to save the SHA256SUMS as a file/text file and the .GPG as a .GPG/.SIG file, GPG4Win gave out an error message when trying to verify the GPG signature, saying that the signature was invalid. This problem is caused by missing line breaks when copying the SHA256SUMS into the editor and save it as a text file (only visible when the editor window is maximized). When I save the SHA256SUMS web site ( as a file/text file, the line breaks stay in the correct format. When verifying the text file and the signature, I finally get the green message saying that the signature is valid.

Thank you for your help.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.