It looks to me like the current Ubuntu 16.04.5 .iso file and its gpg hash aren't matching on releases.ubuntu.com:
Wanting to verify the integrity of the file, I googled it and found https://tutorials.ubuntu.com/tutorial/tutorial-how-to-verify-ubuntu which invites me to DL the sha256sums and sha256sums.gpg
I verify the sha256 signature file comes from Ubuntu
gpg --verify SHA256SUMS.gpg SHA256SUMS
(first get the right keys from ubuntu keysever via
gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 0x46181433FBB75451 0xD94AA3F0EFE21092)
manual sha256 of the .iso
shasum -a 256 ubuntu-16.04.5-desktop-amd64.iso
meanwhile http://releases.ubuntu.com/16.04.5/SHA256SUMS lists
as the expected checksum
=> it appears the 16.04.5 .iso that have been up for more than a month (last modified 2018-07-31) are actually not the ones that the gpg file certify come from Ubuntu.
Did I mess a step in validating the integrity of the file? Who do I contact in the case of checksum mismatch? (it would be good to add that to the tutorial!)
Thanks for advice / guidance, https://tutorials.ubuntu.com/tutorial/tutorial-how-to-verify-ubuntu seem to have some minor issues -
I feel like I've had to run through many hoops to validate the integrity of the iso (first had to install brew
/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
followed by trying to install coreutils to get to sha256sums with no success despite tutorials claiming it would enable the command on OSX... and then had to manually look up how to compute the sha256 hash using
shasum -a 256 <myfile>
I know it's worth it in the end, but it feels like quite a few hoops to jump through to validate the authenticity of a file, any easier way to authenticate .iso files?
// note: I tried the server and desktop versions - did not try the bittorrent files.
EDIT : I opened a new question instead of reworking this one to add all mirrors and releases used at My Ubuntu SHA256SUM doesn't match no matter release or mirror... what am I doing wrong?