I'm trying to securely validate the hash of a downloaded ubuntu-11.04-alternate-amd64.iso but it seems I just can't find any.

I found this site: https://help.ubuntu.com/community/UbuntuHashes
but there are only MD5SUMs on it.

About MD5's security: https://secure.wikimedia.org/wikipedia/en/wiki/MD5#Security

Where are the SHA256 hashes of Ubuntu images?

http://releases.ubuntu.com/11.04/SHA256SUMS is not a solution, because it's not using valid HTTPS.

Verifying the SHA256SUMS with GPG isn't the solution either, because not everyone has the public key, so we have to import it with:

gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 0xFBB75451

and I think using this method could be compromised (when importing the keys).

  • 1
    Let's go back to Q+A business. This is valid question and not a dupe (keep in mind, all close votes automatically expire after two days, so the current three shouldn't hurt). – htorque May 28 '11 at 16:42
  • 2
    Actually, that page is not community editable. – psusi May 29 '11 at 3:11

Currently only MD5 hashes are securely available. If you believe it is necessary to provide SHA256 hashes as well, please file a bug against the Ubuntu website.

Your report will be significantly more well received if you refrain from shouting profanities at those from whom you are seeking help.


Please use the GPG web-of-trust to verify key validity after importing the key.


Ubuntu help: Installation/MinimalCD, section 64-bit PC (amd64, x86_64)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.