Public bug reported: I've downloaded DVD ISO images of Lucid from http://cdimage.ubuntu.com/releases/lucid/release/ and checked their sha256 hashes with "sha256sum -c SHA256SUMS" - it shows everything is correct with files.
But when I check the authenticity of SHA256SUMS file with GnuPG it says that file have BAD signature from "Ubuntu CD Image Automatic Signing Key". Am I doing something wrong with checking the signature? Or SHA256SUMS.gpg file on ubuntu mirrors really did not match the SHA256SUMS file hosted there? Probably signature files (SHA256SUMS.gpg) should be updated on Ubuntu mirrors. I consider this problem to be important because without checking the signature we can't trust in authenticity of ISO images. Here is the full output of commands I have executed to check gpg signatures: # Check SHA256 hash. Everything is OK with both images $ sha256sum -c SHA256SUMS ubuntu-10.04-dvd-amd64.iso: OK ubuntu-10.04-dvd-i386.iso: OK # Download latest SHA256SUMS.gpg file $ wget http://cdimage.ubuntu.com/releases/lucid/release/SHA256SUMS.gpg --02:41:08-- http://cdimage.ubuntu.com/releases/lucid/release/SHA256SUMS.gpg => `SHA256SUMS.gpg' Resolving cdimage.ubuntu.com... 91.189.92.168 Connecting to cdimage.ubuntu.com|91.189.92.168|:80... connected. HTTP request sent, awaiting response... 200 OK Length: 189 [text/plain] 100%[=============================================================>] 189 --.--K/s 02:41:09 (14.02 MB/s) - `SHA256SUMS.gpg' saved [189/189] # Time to check it with gpg $ gpg --verify SHA256SUMS.gpg SHA256SUMS gpg: Signature made Fri Apr 30 11:03:30 2010 EEST using DSA key ID FBB75451 gpg: Can't check signature: public key not found # Oops, we don't have a public key of Ubuntu archive. # Let's download it from the keyserver $ gpg --keyserver keyserver.ubuntu.com --recv-keys FBB75451 gpg: requesting key FBB75451 from hkp server keyserver.ubuntu.com gpg: key FBB75451: public key "Ubuntu CD Image Automatic Signing Key <[email protected]>" imported gpg: 3 marginal(s) needed, 1 complete(s) needed, classic trust model gpg: depth: 0 valid: 1 signed: 1 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: depth: 1 valid: 1 signed: 0 trust: 0-, 0q, 0n, 1m, 0f, 0u gpg: Total number processed: 1 gpg: imported: 1 # Check the fingerprint of the key $ gpg --fingerprint FBB75451 pub 1024D/FBB75451 2004-12-30 Key fingerprint = C598 6B4F 1257 FFA8 6632 CBA7 4618 1433 FBB7 5451 uid Ubuntu CD Image Automatic Signing Key <[email protected]> # Final check of the signature. It FAILS. :( $ gpg --verify SHA256SUMS.gpg SHA256SUMS gpg: Signature made Fri Apr 30 11:03:30 2010 EEST using DSA key ID FBB75451 gpg: BAD signature from "Ubuntu CD Image Automatic Signing Key <[email protected]>" ** Affects: ubuntu Importance: Undecided Status: New -- Bad gpg signature of Lucid DVD iso images https://bugs.launchpad.net/bugs/576152 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
