4

A barrage of verification questions:

The only other question I saw was regarding a torrented .iso. I got mine from https://www.ubuntu.com (Official Site)

My questions:

  1. Do I need truly need verify if it is from the official site? What's the risk?

  2. Don't have gpg command on a mac; can I skip this step?

  3. Did a 256 checksum of my .iso and it did not match the one hosted @ https://www.ubuntu.com/download/how-to-verify... What!? - Re-Downloading to double check...

UPDATE / SOLVED:

This time my SHA256 and GPG verification came out clean.

Here's what I learned:

Download the SHA256 files, don't just copy and paste into a new text file (this will corrupt the output of gpg).

I used curl -O http://releases.ubuntu.com/16.04/SHA256SUMS to download via terminal.

All you need is the SHA256SUMS AND SHA256SUMS.gpg not MD5 and SHA1 etc.

Then follow the steps outlined here: https://www.ubuntu.com/download/how-to-verify (and below if you don't have gpg installed on mac get homebrew package manager and run brew install gnupg

  • If you solved your problem yourself, please answer your own question and accept it. Don’t put the answer in your question or the comments! Send me a message in the comments if you want my up-vote. :-) – David Foerster Jan 5 '17 at 8:53
7

Do I need truly need verify if it is from the official site? What's the risk?

Well, dunno if you noticed, but http://releases.ubuntu.com/ isn't HTTPS. You could have easily downloaded from an impersonating webpage. However, using PGP signing lets you verify that the file is correct and from the Ubuntu team.

Don't have gpg command on a mac; can I skip this step?

Homebrew it: http://brewformulas.org/Gnupg. What's life on a Mac without homebrew or the like?

Did a 256 checksum of my .iso and it did not match the one hosted ...

Can't really say - was the file completely downloaded? Did it get corrupted somehow?

Note that Ubuntu offers official torrents - consider downloading using those for reliability.

|improve this answer|||||
  • Isn't the signature on HTTP as well? releases.ubuntu.com/16.04 – Kolob Canyon Jan 3 '17 at 6:53
  • Yes, but they cannot fake the private key used to sign the signature. – muru Jan 3 '17 at 6:53
  • Thanks for the reply! brew install super helpful – Kolob Canyon Jan 3 '17 at 7:12
  • 1
    OS X without homebrew is like life without Stack Exchange - absolutely hopeless! – Chris Cirefice Jan 3 '17 at 18:20
  • @ChrisCirefice I like homebrew. The thing that gets me about package managers, is how do I trust the repository? I understand for apt-get it is checked by human eyes; it seems like you could easily sneak in malware or some garbage and I've always been curious on how to protect from that, or how the admins of the repository protect from that – Kolob Canyon Jan 5 '17 at 8:19
4

Answer to the question asked:

  1. Do I need truly need verify if it is from the official site? What's the risk?

    • You need to do this so you don't get a copy that has been altered to give some one or some organization access to your system and hence information
  2. Don't have gpg command on a mac; can I skip this step?

    • Yes you can, use the alternative listed instead
  3. Did a 256 checksum of my .iso and it did not match the one hosted @ https://www.ubuntu.com/download/how-to-verify... What!? - Re-Downloading to double check...

    • Please checked that you followed the instructions there to the latter, and besides they are many other factors that could have caused this. But after this if your still not okay then I guess support should come in handy.
|improve this answer|||||
  • I guess I should have asked, can I safely skip that step? – Kolob Canyon Jan 3 '17 at 6:58
  • +1 anyway, helpful to me as well – Kolob Canyon Jan 3 '17 at 7:16
  • @KolobCanyon I guess if it's broken they always say to compare the checksum. I never have... – WinEunuuchs2Unix Jan 3 '17 at 7:25
  • @WinEunuuchs2Unix I hardly check myself as I usually verify the site via the https and or site online rep. – George Udosen Jan 3 '17 at 7:28
  • @George I'm just lazy and don't really care about virus, malware and the NSA :) – WinEunuuchs2Unix Jan 3 '17 at 7:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.