14

I just downloaded the ubuntu-10.10-desktop-i386.iso, and am having a hard time burning it, so I'd like to check that the file is intact, but I cannot find the md5sum of the file.

Is there a URL or official FTP mirror which includes the md5sum of the Ubuntu disk images?

0

7 Answers 7

13

https://help.ubuntu.com/community/UbuntuHashes

In your case the md5sum is 59d15a16ce90c8ee97fa7c211b7673a8

1
  • Please update as nessecary.
    – fosslinux
    Aug 1, 2017 at 4:16
7

MD5 & SHA-1/SHA-256 hashes are available in the actual releases folder. Look for the filenames "MD5SUMS" & "SHA1SUMS"/ "SHA256SUMS"

For example:

http://releases.ubuntu.com/16.04/

OR

http://releases.ubuntu.com/17.04/

if you scroll down to the list of files. Downloads & hashes for previous supported releases are also available on releases.ubuntu.com

1
  • Please update as nessecary.
    – fosslinux
    Aug 1, 2017 at 4:16
6

Take a look here:

https://help.ubuntu.com/community/UbuntuHashes

2
  • Really. When I typed my answer I saw nothing, but when I submitted I saw your answer. (How can that happen?) May 2, 2012 at 23:22
  • oh. I'll delete my answer May 2, 2012 at 23:23
6

This addresses the situation where a checksum is missing from the UbuntuHashes page (like what happened in that question). It's somewhat similar to that answer here (that one too) but is more of a walkthrough and explains specifically how to find checksums for any Ubuntu ISO image.

Anytime the UbuntuHashes page is missing a hash, you can check on any of the download servers. Considering that hashes are small and the official, central servers might be less likely to have corrupted or tampered files than others (probably a relatively small risk anyway), I'd suggest using the official, central servers for this.

The most commonly used ISO images for all currently supported releases are available on:

For less commonly used ISO images, like PowerPC images and daily-live images for the development version:

For releases that have reached end-of-life (which you should not run because they don't even get updated when security bugs are discovered):

Go to whichever site applies and click on the version of Ubuntu you're interested in. In this example, it's Ubuntu 12.04.3 LTS Precise Pangolin:

Scroll down and click on the file MD5SUMS. That shows them. (I've reproduced them below for convenience, but of course you should check the real site.)

ca4ecd32f1a4c6917c951f45395901ff *ubuntu-12.04.3-alternate-amd64.iso
927f06b00821cb4069ce359fe1ec7edb *ubuntu-12.04.3-alternate-i386.iso
e2da0d5ac2ab8bedaa246869e30deb71 *ubuntu-12.04.3-desktop-amd64.iso
c4f4c7a0d03945b78e23d3aa4ce127dc *ubuntu-12.04.3-desktop-i386.iso
2cbe868812a871242cdcdd8f2fd6feb9 *ubuntu-12.04.3-server-amd64.iso
e7917ff0543d8248d00ffb166def849e *ubuntu-12.04.3-server-i386.iso
eed92cd490736ad54e3076b168ffd7ac *ubuntu-12.04.3-wubi-amd64.tar.xz
a9ea62ad52681dca4e3a832436b32ba0 *ubuntu-12.04.3-wubi-i386.tar.xz
da0cd423b2b4e4b899751f05a27adba0 *wubi.exe

Finally, please note that the MD5SUMS.gpg file is the Ubuntu project's digital signature. Hardly anybody verifies that in this situation (as far as I know), but if you did use GPG to verify it and check the MD5SUMS file against it, then you'd essentially know for sure that they were the correct MD5SUMS. (Of course anyone can create a .gpg file that looks right and signs the file, but it wouldn't check out as being signed with the project's key.)

If you're interested in more information about verifying GPG signatures on checksum files for Ubuntu downloads, I recommend posting a new question.

2

Here you go: UbuntuHashes.

0

If you hit any key while the LiveCD is starting, a menu will appear. There is a entry in this menu to check the media. It will auto-check the md5 sum.

Note that this will not protect you against forgery or a corrupt download, only against a defective burning.

2
  • If I have a corrupt download and it doesn't burn properly, I clearly won't be able to boot off it.
    – Jack M.
    Oct 25, 2010 at 16:43
  • 2
    No. I have seem plenty of corrupted CDs that will boot nicely but fail while installing or just while booting some random program. Assuming that the corruption will happen in a place critical to boot is just wrong. Oct 25, 2010 at 17:26
0

The 'releases' subdomain includes all the files associated with a specific release including the md5 hashes. Its also been the home of ubuntu's releases since 2004 so its probably not going away anytime soon. http://releases.ubuntu.com/precise/

0

Not the answer you're looking for? Browse other questions tagged .