Every time I try to verify my download, it comes back as bad. I’m doing my best to follow the guide, but I just can’t get it to work. I tried it first on Windows 10, and these last few attempts have been on a fresh Ubuntu install of 24.04.3
From where did you download the SHA256SUMS and SHA256SUMS.gpg ? I just now downloaded them from releases.ubuntu.com and got
❯ LANG=C gpg --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS
gpg: Signature made Do 07 Aug 2025 12:34:34 CEST
gpg: using RSA key 843938DF228D22F7B3742BC0D94AA3F0EFE21092
gpg: Good signature from "Ubuntu CD Image Automatic Signing Key (2012) <cdimage@ubuntu.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 8439 38DF 228D 22F7 B374 2BC0 D94A A3F0 EFE2 1092
So either one or both of your files is not what it should be.
The easiest way to get a correct ISO is to download through bit torrent. Torrents are checksummed on multiple levels (per block,per part, per file). It’s astronomically unlikely for a file to be wrong and get through all the checksumming that’s part of a torrent.
I simply right click the SHA256SUMS file on the page and then select ‘Save as’. That’s necessary because it’s a simple text file and browsers default to showing those – and that’s not quite what you want. That file contains all the checksums for all the ISO files along with the names. When you run sha256sums -c SHA256SUMS it reads the names and sums from the files and tries to verify all of them. You’d get several errors along the lines of ‘file not found’ and for the ones you actually downloaded you either get a OK or different error.
There’s a page here that gives step by step instructions.
The fourth step (the whole get the key and run gpg thing) checks the SHA256SUMS file against a cryptographical signature in the file SHA256SUMS.gpg to make sure you actually have the right file with the right checksums – which you don’t …
Thanks, that fixed it. That page you have linked is what I’ve been using. All I had to do was use “Save as” like you said and then save it without the .gpg file extension so it doesn’t overwrite the other file. Came back good this time
