I downloaded the Ubuntu iso and did a shasum on it as per the instructions on the website and it matched with the value of the website. Now, the ISO needs to be mounted on a USB drive. There is an application called 'Startup Disk Creator' to do this. Now, my concern is that what if this startup disk creator application itself is compromised? So I need some way of verifying that the bootable USB drive itself is genuine. I tried some methods like given below:
$ stat -c '%s' ubuntu-20.04-desktop-amd64.iso
$ sudo cmp -n 2715254784 ubuntu-20.04-desktop-amd64.iso /dev/sdb1
ubuntu-20.04-desktop-amd64.iso /dev/sdb1 differ: byte 1, line 1
but I'm getting a difference in the very first byte. Is there some way of directly authenticating the live bootable usb drive?
Now I understand that there is a md5sum algorithm which can verify this, but this algorithm is considered to be insecure. I want to use sha256.