4

I want to download and verify the ISO of lubuntu. The problem is I can't find a secure channel in the first place. The official ISO here is being downloaded with http (not https). Of course I can download and then verify the hash, but the only place I can find the hashes is here, which is also insecure http.
Any way to securely download the ISO?

Edit:
The proposed duplicate question is not similar to my case - it talks about downloading using apt, which uses an authentication mechanism (no user action needed). My questions is about files downloaded manually, thus I must authenticate the files by myself.

2
  • Edited for clarifications
    – Jona
    Oct 3, 2017 at 18:12
  • 1
    IMO this is an X/Y problem, you are essensialy asking about why Ubuntu uses http and not https, as that was your issue with the page. That is answerd in the duplicate.
    – Mark Kirby
    Oct 3, 2017 at 18:14

1 Answer 1

5

You can download all the official Ubuntu and Ubuntu community flavour iso files (Kubuntu, Lubuntu, ... Xubuntu) via this link,

http://releases.ubuntu.com/

For Lubuntu you arrive at

http://cdimage.ubuntu.com/lubuntu/releases/

and yes, these are http (not https) URLs.

But there is a signing mechanism. The gpg-files contain signatures from Ubuntu, and they can be used to verify that the MD5SUMS or the stronger SHA256SUMS are correct.

The accepted answer at the following link describes how to verify the checksum files with all the necessary details,

verifiying ubuntu iso with repository gpg-keys

2
  • 2
    You probably want to include how to actually verify the MD5s and such in your answer. Chances are the OP doesn't know how to do that, or else he wouldn't be asking this question :) Oct 3, 2017 at 17:53
  • Thanks for the tip, @AndroidDev. I added a small paragraph and a link to what I think is a detailed description (an AskUbuntu link).
    – sudodus
    Oct 3, 2017 at 18:00

Not the answer you're looking for? Browse other questions tagged .