It looks to me like the current Ubuntu 16.04.5 .iso file and its gpg hash aren't matching on releases.ubuntu.com:

  1. I DL'd /16.04.5/ubuntu-16.04.5-desktop-amd64.iso (http://releases.ubuntu.com/xenial and http://tw.releases.ubuntu.com/16.04)

  2. Wanting to verify the integrity of the file, I googled it and found https://tutorials.ubuntu.com/tutorial/tutorial-how-to-verify-ubuntu which invites me to DL the sha256sums and sha256sums.gpg

  3. I verify the sha256 signature file comes from Ubuntu

    gpg --verify SHA256SUMS.gpg SHA256SUMS

(first get the right keys from ubuntu keysever via gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 0x46181433FBB75451 0xD94AA3F0EFE21092)

  1. manual sha256 of the .iso shasum -a 256 ubuntu-16.04.5-desktop-amd64.iso


     c66919536dc9dfa46353a195db25b37328bb5c66eaa382ff79b285c2c39d22fb ubuntu-16.04.5-desktop-amd64.iso

    meanwhile http://releases.ubuntu.com/16.04.5/SHA256SUMS lists


    as the expected checksum

    => it appears the 16.04.5 .iso that have been up for more than a month (last modified 2018-07-31) are actually not the ones that the gpg file certify come from Ubuntu.

Did I mess a step in validating the integrity of the file? Who do I contact in the case of checksum mismatch? (it would be good to add that to the tutorial!)

Thanks for advice / guidance, https://tutorials.ubuntu.com/tutorial/tutorial-how-to-verify-ubuntu seem to have some minor issues - I feel like I've had to run through many hoops to validate the integrity of the iso (first had to install brew via /usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)" followed by trying to install coreutils to get to sha256sums with no success despite tutorials claiming it would enable the command on OSX... and then had to manually look up how to compute the sha256 hash using shasum -a 256 <myfile>

I know it's worth it in the end, but it feels like quite a few hoops to jump through to validate the authenticity of a file, any easier way to authenticate .iso files?

// note: I tried the server and desktop versions - did not try the bittorrent files.

EDIT : I opened a new question instead of reworking this one to add all mirrors and releases used at My Ubuntu SHA256SUM doesn't match no matter release or mirror... what am I doing wrong?

  • I am not sure what I am doing wrong - I pulled an official mirror from guiverc's url pool (launchpad.net/ubuntu/+mirror/debian.linux.org.tw-release) and tried DL'ing iso, validating the signature files, and still am unable to get the same sha256 hash... ISO sha 256 hash: d56a77c9a9ffef5aafe9a4bec93b35e3f72438e61344e639b488c1da1d0d6a8f . Listed hash in sha256: 6b505fd3b6f816f8ff058710f127a9900e9233e496783ce08a0022814d224810 – FJX Sep 4 '18 at 2:31

Where did you download your Ubuntu 16.04.5 ISO from?

To test your assumption,

  1. I downloaded the ISO taking 1hr 31 mins 1s from my local [official] mirror
  2. I downloaded the SHA256SUM file (for diff from main site)

The result was

6b505fd3b6f816f8ff058710f127a9900e9233e496783ce08a0022814d224810  ubuntu-16.04.5-desktop-amd64.iso

exactly what it should have been according to the official site.

Where did you download it from? or maybe it failed because of a bad connection (it's not matching because your download is invalid)

As for whom do you contact - if you think there is a problem in the documentation, file a bug on launchpad [with ubuntu-docs as the package].

As for a bad download - I think the check sum is correct, your download was corrupted (in my opinion), or you downloaded your ISO from a corrupt or invalid site. At least my copy matched perfectly.

note: by official mirror, I mean it's one found on https://launchpad.net/ubuntu/+cdmirrors

You listed the command used to grab the gpg keys as gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 0xZZZZZ 0xZZZZZ which was not what I used, nor what I saw in the documentation. Did you replace the real key you used with Z's? or feel that information was private so hid it?

  • This may not strictly be an answer - it was way too long for a comment... – guiverc Sep 3 '18 at 12:43
  • Probably the first thing I would check is grabbing another smaller file, and comparing it's sha256sum with what it should be. It could be the binary/program you are using to create the sha256sum is invalid; thus giving incorrect answers. Try using a different machine (different program) to sha256sum the downloaded iso - does it too create the same ISO? Next I'd try using another internet connection to try downloading the ISO. – guiverc Sep 4 '18 at 2:36
  • I'm on OSX - there is no sha256sum function I can call: I am using shasum -a 256 <myfile> which should work the same. I'm still investigating. – FJX Sep 4 '18 at 2:40
  • 1
    I opened a new question instead of reworking this one to add all mirrors and releases used at askubuntu.com/questions/1072202/… – FJX Sep 5 '18 at 3:12
  • 1
    You could try the zsync download with the local (bad) copy of the iso to patch it. Should be pretty quick if only a few bad spots. – ubfan1 Sep 5 '18 at 4:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.