This addresses the situation where a checksum is missing from the UbuntuHashes page (like what happened in that question). It's somewhat similar to that answer here (that one too) but is more of a walkthrough and explains specifically how to find checksums for any Ubuntu ISO image.
Anytime the UbuntuHashes page is missing a hash, you can check on any of the download servers. Considering that hashes are small and the official, central servers might be less likely to have corrupted or tampered files than others (probably a relatively small risk anyway), I'd suggest using the official, central servers for this.
The most commonly used ISO images for all currently supported releases are available on:
For less commonly used ISO images, like PowerPC images and daily-live images for the development version:
For releases that have reached end-of-life (which you should not run because they don't even get updated when security bugs are discovered):
Go to whichever site applies and click on the version of Ubuntu you're interested in. In this example, it's Ubuntu 12.04.3 LTS Precise Pangolin:
Scroll down and click on the file MD5SUMS
. That shows them. (I've reproduced them below for convenience, but of course you should check the real site.)
ca4ecd32f1a4c6917c951f45395901ff *ubuntu-12.04.3-alternate-amd64.iso
927f06b00821cb4069ce359fe1ec7edb *ubuntu-12.04.3-alternate-i386.iso
e2da0d5ac2ab8bedaa246869e30deb71 *ubuntu-12.04.3-desktop-amd64.iso
c4f4c7a0d03945b78e23d3aa4ce127dc *ubuntu-12.04.3-desktop-i386.iso
2cbe868812a871242cdcdd8f2fd6feb9 *ubuntu-12.04.3-server-amd64.iso
e7917ff0543d8248d00ffb166def849e *ubuntu-12.04.3-server-i386.iso
eed92cd490736ad54e3076b168ffd7ac *ubuntu-12.04.3-wubi-amd64.tar.xz
a9ea62ad52681dca4e3a832436b32ba0 *ubuntu-12.04.3-wubi-i386.tar.xz
da0cd423b2b4e4b899751f05a27adba0 *wubi.exe
Finally, please note that the MD5SUMS.gpg
file is the Ubuntu project's digital signature. Hardly anybody verifies that in this situation (as far as I know), but if you did use GPG to verify it and check the MD5SUMS
file against it, then you'd essentially know for sure that they were the correct MD5SUMS
. (Of course anyone can create a .gpg
file that looks right and signs the file, but it wouldn't check out as being signed with the project's key.)
If you're interested in more information about verifying GPG signatures on checksum files for Ubuntu downloads, I recommend posting a new question.