I was following the "How to verify your Ubuntu download" tutorial to verify the ubuntu-18.04.5-desktop-amd64.iso download.
After the following command
gpg --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS
I receive the following message:
gpg: Signature made Thu 13 avg 2020 17:02:20 CEST gpg: using RSA key 843938DF228D22F7B3742BC0D94AA3F0EFE21092 gpg: BAD signature from "Ubuntu CD Image Automatic Signing Key (2012) <firstname.lastname@example.org>" [unknown]
I've downloaded all the files (SHA256SUMS.gpg, SHA256SUMS, iso file) from the Ubuntu 18.04.5 LTS (Bionic Beaver) page.
I've been told that there is a similar question answered here. I acknowledge this. But (1) the question is rather old, maybe in the meantime the files SHA256SUMS and SHA256SUMS.gpg have changed and (2) the answers in that question do not answer my problem. I have downloaded the files with Save Link As... from Firefox browser.
It would help me if I get confirmation that the files are ok; then the problem is on my side. Then any help what the problem might be would be useful.
Edit: it seems there are others with the same problem. So there may be something wrong with the signature.