1

As titled: Ubuntu .iso files and their respective sha256 hashes aren't matching for me.

I have tried downloading four different release .iso (from four different official mirrors) and have not been able to get the expected hash as listed in the releases's folder (as listed in SHA256SUMS file). [using OSX 10.13.6/ new machine]

Meanwhile - have confirmed with @guiverc that we both get the same sha256sum for the following file: http://archive.ubuntu.com/ubuntu/pool/universe/w/wallpaper/wallpaper_0.1-1ubuntu1_all.deb (Sha256 hash: 5ca9c4e438fa4d9c9b81682e520a41df6ce042934c8a8a88be4acbbf1282a354) ... I will try to DL the iso from a diff machine on a diff network and see if I manage to get the proper checksum... Advice welcome.

Steps I took:

  1. DL'd /16.04.5/ubuntu-16.04.5-desktop-amd64.iso (http://tw.releases.ubuntu.com/16.04)

Googled how to verify the integrity of the file: https://tutorials.ubuntu.com/tutorial/tutorial-how-to-verify-ubuntu

  1. I verify the sha256 signature file comes from Ubuntu

    gpg --verify SHA256SUMS.gpg SHA256SUMS

(first get the right keys from ubuntu keysever via gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 0x46181433FBB75451 0xD94AA3F0EFE21092)

  1. manual sha256 of the .iso via shasum -a 256 ubuntu-16.04.5-desktop-amd64.iso

produces c66919536dc9dfa46353a195db25b37328bb5c66eaa382ff79b285c2c39d22fb ubuntu-16.04.5-desktop-amd64.iso but SHA256SUMS expects 6b505fd3b6f816f8ff058710f127a9900e9233e496783ce08a0022814d224810

instead of (3.) alternatively tried 3'. manual sha256 of the .iso via sha256sum ubuntu-16.04.5-desktop-amd64.iso using the linked coreutil function for osx... same results

Did I mess a step in validating the integrity of the file? Who do I contact in the case of checksum mismatch? (it would be good to add that to the tutorial!)

I've had to run through many hoops it feels: first had to install brew via /usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)", second, trying to install coreutils to get to sha256sums with no success despite tutorials claiming it would enable the command on OSX, third manually looked up how to compute the sha256 hash (using shasum -a 256 <myfile>) - and finally trying linking the coreutil gsha256sum function (sudo ln -s /usr/local/bin/gsha256sum /usr/local/bin/sha256sum) But STILL cannot get a downloaded iso to match the expected sha256sum as listed in the release SHA256SUMS file.

Attempts (diff releases, official mirrors...):

18.04 from http://ftp.ubuntu-tw.net/ubuntu-releases/18.04/sha256sum ubuntu-18.04.1-desktop-amd64.iso 2e67d2822abd4c835edc38ef062eaec9053728de3bad9992561cba04491d5fe5 ubuntu-18.04.1-desktop-amd64.iso 
(expected: 5748706937539418ee5707bd538c4f5eabae485d17aa49fb13ce2c9b70532433)

16.04.5 from http://mirror.sjc02.svwh.net/ubuntu-releases/xenial/

 sha256sum ubuntu-16.04.5-desktop-amd64.iso cecf336bd7fcd1f00b03a3a9e10ebfdfd9ba51ac2ad07da405e13c985e9449dd ubuntu-16.04.5-desktop-amd64.iso
 (expected 6b505fd3b6f816f8ff058710f127a9900e9233e496783ce08a0022814d224810)

12.04.5 from http://mirrors.mit.edu/ubuntu-releases/releases/12.04/ sha256sum ubuntu-12.04.5-desktop-amd64.iso 0f5d6331273bb2313f97bbeb12c142cbbce9e6d7b8e18aacbb6c1caf429bea33 ubuntu-12.04.5-desktop-amd64.iso (expected: d1f10ea7ca59266567fa8d2522ad800e1aa063f139630f925d2484d8e169b4c2)

  • How are you downloading? I have had a zsync produce a bad checksum on an iso, but only once out of many times. Torrents and direct downloads have never failed for me. – ubfan1 Sep 5 '18 at 4:28
  • http / direct download – FJX Sep 5 '18 at 6:05
  • just tried downloading a file from (tw.releases.ubuntu.com/16.04) on a diff network and I get the proper sha256sum: sha256sum ubuntu-16.04.5-desktop-amd64.iso 6b505fd3b6f816f8ff058710f127a9900e9233e496783ce08a0022814d224810 ubuntu-16.04.5-desktop-amd64.iso – FJX Sep 6 '18 at 0:59
0

There appears to be a custom configuration on one network that is corrupting the download, and changing the sha256sum of the file. I have taken the same computer on a different network and I am getting the proper sha256sum result. I will ask the network admin at a later time, but moving on from this one. Thanks for @guiverc for pointing me in the right direction in a separate Q related to this very issue!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.