I was following the "How to verify your Ubuntu download" tutorial to verify the ubuntu-18.04.5-desktop-amd64.iso download.

After the following command

gpg --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS

I receive the following message:

gpg: Signature made Thu 13 avg 2020 17:02:20 CEST 
gpg:                using RSA key 843938DF228D22F7B3742BC0D94AA3F0EFE21092 
gpg: BAD signature from "Ubuntu CD Image Automatic Signing Key (2012) <cdimage@ubuntu.com>" [unknown]

I've downloaded all the files (SHA256SUMS.gpg, SHA256SUMS, iso file) from the Ubuntu 18.04.5 LTS (Bionic Beaver) page.

I've been told that there is a similar question answered here. I acknowledge this. But (1) the question is rather old, maybe in the meantime the files SHA256SUMS and SHA256SUMS.gpg have changed and (2) the answers in that question do not answer my problem. I have downloaded the files with Save Link As... from Firefox browser.

It would help me if I get confirmation that the files are ok; then the problem is on my side. Then any help what the problem might be would be useful.

Edit: it seems there are others with the same problem. So there may be something wrong with the signature.

  • Delete SHA256SUMS.gpg, SHA256SUMS files and download them again from the website and try verifying. Aug 22, 2020 at 11:04

1 Answer 1


A new signature file SHA256SUMS.gpg has been posted on August 17th to the Ubuntu 18.04.5 LTS (Bionic Beaver) page.

The file SHA256SUMS.gpg was last modified on 2020-08-17 12:28 with the size of 833.

Now the verifying process is OK.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.