Question

6

rated 0 times [ 6] [ 0] / answers: 1 / hits: 1964 / 2 Years ago, fri, september 9, 2022, 5:51:20

I'm trying to securely validate the hash of a downloaded ubuntu-11.04-alternate-amd64.iso but it seems I just can't find any.

I found this site: https://help.ubuntu.com/community/UbuntuHashes

but there are only MD5SUMs on it.

Where are the SHA256 hashes of Ubuntu images?

http://releases.ubuntu.com/11.04/SHA256SUMS is not a solution, because it's not using valid HTTPS.

Verifying the SHA256SUMS with GPG isn't the solution either, because not everyone has the public key, so we have to import it with:

gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 0xFBB75451

and I think using this method could be compromised (when importing the keys).

Only authorized users can answer the question. Please sign in first, or register a free account.

Total Points: 259

Total Questions: 131

Total Answers: 106

Location: Venezuela

Member since Sun, Oct 2, 2022

2 Years ago

measord questions

Wed, Jul 14, 21, 21:39, 3 Years ago

Mon, May 16, 22, 21:12, 2 Years ago

Wed, May 24, 23, 19:05, 1 Year ago

Mon, Oct 11, 21, 03:11, 3 Years ago

Sun, Apr 17, 22, 21:22, 2 Years ago

answered 2 Years ago overine · Accepted Answer

Currently only MD5 hashes are securely available. If you believe it is necessary to provide SHA256 hashes as well, please file a bug against the Ubuntu website.

Your report will be significantly more well received if you refrain from shouting profanities at those from whom you are seeking help.