Bad signature on verifying the 18.04.5 sha256 checksum

Question

I was following the "How to verify your Ubuntu download" tutorial to verify the ubuntu-18.04.5-desktop-amd64.iso download.

After the following command

gpg --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS

I receive the following message:

gpg: Signature made Thu 13 avg 2020 17:02:20 CEST 
gpg:                using RSA key 843938DF228D22F7B3742BC0D94AA3F0EFE21092 
gpg: BAD signature from "Ubuntu CD Image Automatic Signing Key (2012) <cdimage@ubuntu.com>" [unknown]

I've downloaded all the files (SHA256SUMS.gpg, SHA256SUMS, iso file) from the Ubuntu 18.04.5 LTS (Bionic Beaver) page.

I've been told that there is a similar question answered here. I acknowledge this. But (1) the question is rather old, maybe in the meantime the files SHA256SUMS and SHA256SUMS.gpg have changed and (2) the answers in that question do not answer my problem. I have downloaded the files with Save Link As... from Firefox browser.

It would help me if I get confirmation that the files are ok; then the problem is on my side. Then any help what the problem might be would be useful.

Edit: it seems there are others with the same problem. So there may be something wrong with the signature.

Answer 1

A new signature file SHA256SUMS.gpg has been posted on August 17th to the Ubuntu 18.04.5 LTS (Bionic Beaver) page.

The file SHA256SUMS.gpg was last modified on 2020-08-17 12:28 with the size of 833.

Now the verifying process is OK.