Monday, April 15, 2024
 Popular · Latest · Hot · Upcoming
6
rated 0 times [  6] [ 0]  / answers: 1 / hits: 1956  / 2 Years ago, fri, september 9, 2022, 5:51:20

I'm trying to securely validate the hash of a downloaded ubuntu-11.04-alternate-amd64.iso but it seems I just can't find any.



I found this site: https://help.ubuntu.com/community/UbuntuHashes

but there are only MD5SUMs on it.



About MD5's security: https://secure.wikimedia.org/wikipedia/en/wiki/MD5#Security



Where are the SHA256 hashes of Ubuntu images?



http://releases.ubuntu.com/11.04/SHA256SUMS is not a solution, because it's not using valid HTTPS.



Verifying the SHA256SUMS with GPG isn't the solution either, because not everyone has the public key, so we have to import it with:



gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 0xFBB75451


and I think using this method could be compromised (when importing the keys).


More From » security

 Answers
1

Currently only MD5 hashes are securely available. If you believe it is necessary to provide SHA256 hashes as well, please file a bug against the Ubuntu website.



Your report will be significantly more well received if you refrain from shouting profanities at those from whom you are seeking help.


[#44918] Saturday, September 10, 2022, 2 Years  [reply] [flag answer]
Only authorized users can answer the question. Please sign in first, or register a free account.
measord

Total Points: 259
Total Questions: 131
Total Answers: 106

Location: Venezuela
Member since Sun, Oct 2, 2022
2 Years ago
measord questions
Wed, Jul 14, 21, 21:39, 3 Years ago
Mon, May 16, 22, 21:12, 2 Years ago
Mon, Oct 11, 21, 03:11, 3 Years ago
Sun, Apr 17, 22, 21:22, 2 Years ago
;