1

I downloaded the Ubuntu iso and did a shasum on it as per the instructions on the website and it matched with the value of the website. Now, the ISO needs to be mounted on a USB drive. There is an application called 'Startup Disk Creator' to do this. Now, my concern is that what if this startup disk creator application itself is compromised? So I need some way of verifying that the bootable USB drive itself is genuine. I tried some methods like given below:

$ stat -c '%s' ubuntu-20.04-desktop-amd64.iso

2715254784

$ sudo cmp -n 2715254784 ubuntu-20.04-desktop-amd64.iso /dev/sdb1

ubuntu-20.04-desktop-amd64.iso /dev/sdb1 differ: byte 1, line 1

but I'm getting a difference in the very first byte. Is there some way of directly authenticating the live bootable usb drive?

Now I understand that there is a md5sum algorithm which can verify this, but this algorithm is considered to be insecure. I want to use sha256.

Improve this question
2
  • 1
    Beginning with 20.04, the Desktop installer runs it's own hash (SHASUM) validation during it's boot. This is to let folks know if their .iso download is incomplete or corrupt.
    – user535733
    May 4, 2020 at 0:16
  • 1
    If you don't trust an application, then verify that there is a problem: Every package (including Startup Disk Creator) is signed and hashed. Apt checks the hash when downloading (indeed it identifies the package by the hash), and will terminate with an error is the package is corrupt or tampered with. If you verify that a package in the Ubuntu repositories has been tampered with, the Ubuntu Security Team will be happy to investigate.
    – user535733
    May 4, 2020 at 0:26

1 Answer 1

Reset to default
0

Here's one way to compare SHA256 Sums on the Ubuntu 20.04 Desktop and Server installers:

  1. Web Browser: https://releases.ubuntu.com/20.04/
  2. Download the SHA256SUMS file
  3. Using any convenient SHA256 method to generate the checksum on your downloaded .iso.
    • In Ubuntu: sha256sum /path/to/downloaded_file.iso
    • The sha256sum application is included in the coreutils package.
  4. Compare your result with the SHA256SUMS file.
Improve this answer
1
  • 2
    I want to do a sha256 sum on the bootable drive itself, not the iso image.
    – user15740
    May 4, 2020 at 0:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.