4

A barrage of verification questions:

The only other question I saw was regarding a torrented .iso. I got mine from https://www.ubuntu.com (Official Site)

My questions:

  1. Do I need truly need verify if it is from the official site? What's the risk?

  2. Don't have gpg command on a mac; can I skip this step?

  3. Did a 256 checksum of my .iso and it did not match the one hosted @ https://www.ubuntu.com/download/how-to-verify... What!? - Re-Downloading to double check...

UPDATE / SOLVED:

This time my SHA256 and GPG verification came out clean.

Here's what I learned:

Download the SHA256 files, don't just copy and paste into a new text file (this will corrupt the output of gpg).

I used curl -O http://releases.ubuntu.com/16.04/SHA256SUMS to download via terminal.

All you need is the SHA256SUMS AND SHA256SUMS.gpg not MD5 and SHA1 etc.

Then follow the steps outlined here: https://www.ubuntu.com/download/how-to-verify (and below if you don't have gpg installed on mac get homebrew package manager and run brew install gnupg

1
  • If you solved your problem yourself, please answer your own question and accept it. Don’t put the answer in your question or the comments! Send me a message in the comments if you want my up-vote. :-) Jan 5, 2017 at 8:53

2 Answers 2

7

Do I need truly need verify if it is from the official site? What's the risk?

Well, dunno if you noticed, but http://releases.ubuntu.com/ isn't HTTPS. You could have easily downloaded from an impersonating webpage. However, using PGP signing lets you verify that the file is correct and from the Ubuntu team.

Don't have gpg command on a mac; can I skip this step?

Homebrew it: http://brewformulas.org/Gnupg. What's life on a Mac without homebrew or the like?

Did a 256 checksum of my .iso and it did not match the one hosted ...

Can't really say - was the file completely downloaded? Did it get corrupted somehow?

Note that Ubuntu offers official torrents - consider downloading using those for reliability.

10
  • Isn't the signature on HTTP as well? releases.ubuntu.com/16.04 Jan 3, 2017 at 6:53
  • Yes, but they cannot fake the private key used to sign the signature.
    – muru
    Jan 3, 2017 at 6:53
  • Thanks for the reply! brew install super helpful Jan 3, 2017 at 7:12
  • 1
    OS X without homebrew is like life without Stack Exchange - absolutely hopeless! Jan 3, 2017 at 18:20
  • @ChrisCirefice I like homebrew. The thing that gets me about package managers, is how do I trust the repository? I understand for apt-get it is checked by human eyes; it seems like you could easily sneak in malware or some garbage and I've always been curious on how to protect from that, or how the admins of the repository protect from that Jan 5, 2017 at 8:19
4

Answer to the question asked:

  1. Do I need truly need verify if it is from the official site? What's the risk?

    • You need to do this so you don't get a copy that has been altered to give some one or some organization access to your system and hence information
  2. Don't have gpg command on a mac; can I skip this step?

    • Yes you can, use the alternative listed instead
  3. Did a 256 checksum of my .iso and it did not match the one hosted @ https://www.ubuntu.com/download/how-to-verify... What!? - Re-Downloading to double check...

    • Please checked that you followed the instructions there to the latter, and besides they are many other factors that could have caused this. But after this if your still not okay then I guess support should come in handy.
5
  • I guess I should have asked, can I safely skip that step? Jan 3, 2017 at 6:58
  • +1 anyway, helpful to me as well Jan 3, 2017 at 7:16
  • @KolobCanyon I guess if it's broken they always say to compare the checksum. I never have... Jan 3, 2017 at 7:25
  • @WinEunuuchs2Unix I hardly check myself as I usually verify the site via the https and or site online rep. Jan 3, 2017 at 7:28
  • @George I'm just lazy and don't really care about virus, malware and the NSA :) Jan 3, 2017 at 7:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.