9

I'm trying to download ubuntu desktop securely.

This is the link on the ubuntu.com website: http://releases.ubuntu.com/14.04.2/ubuntu-14.04.2-desktop-i386.iso

And here is the SHA256 hash link: http://releases.ubuntu.com/trusty/SHA256SUMS

Problem is, both these links are http, and the ubuntu.com server doesn't seem to support https. Is there any way I can download the .iso securely?

8
  • 3
    Use BitTorrent with required encryption. – s3lph Jun 18 '15 at 13:29
  • 2
    Why do you need it? Do you want to hide the fact of downloading or what? Checksum is enough to be sure nothing has changed. – Pilot6 Jun 18 '15 at 13:29
  • 1
    HTTPS or another secure way of transfering would protect you from anyone knowing that you downloaded Ubuntu and the checksum. In order to avoid manipulated downloads (it'd be necessary to manipulate both) you have to protect yourself against man-in-the-middle attacks on the client side. – Karl Richter Jun 18 '15 at 13:38
  • HTTPS MD5 hashes are available here. – Doug Smythies Jun 18 '15 at 14:08
  • 2
    @Pilot6 - I need it to ensure that the .iso is the one officially released by ubuntu. Plain http requests allow a 'man in the middle' to change the .iso file on the fly easily. Unfortunately the same problem applies to the checksum - if I cannot obtain it over https then I cannot trust that is has not been tampered with. – Mark Jun 19 '15 at 2:06
2

The key fingerprints are on https://help.ubuntu.com/community/VerifyIsoHowto

Currently they are

C598 6B4F 1257 FFA8 6632  CBA7 4618 1433 FBB7 5451
8439 38DF 228D 22F7 B374  2BC0 D94A A3F0 EFE2 1092

You can retrieve them both with:

gpg --recv-key 843938DF228D22F7B3742BC0D94AA3F0EFE21092 C5986B4F1257FFA86632CBA746181433FBB75451

If you're already on an Ubuntu system the package ubuntu-keyring has these keys in /usr/share/keyrings/ubuntu-archive-keyring.gpg which you can import with gpg --import /usr/share/keyrings/ubuntu-archive-keyring.gpg.

1
  • This also works from Debian 8, apparently. (And thank you!) – treat your mods well Jul 4 '16 at 2:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.