When we download a GNU/Linux distribution, the usual thing is to download the Create an ISO image and start creating the bootable USB drive. Without giving much thought to what might have happened along the way. The truth is, even though often nothing goes wrong, we're blindly trusting that the ISO is legitimate. That no one has touched it and that the download hasn't been corrupted.
If we're talking about a complete operating system, things change. These are large files, they take a long time to download, and above all, A failure or manipulation in the ISO can compromise the entire teamThat's why in the Linux world it's so common (and so recommended) to verify the integrity and authenticity of ISOs using checksums and GPG signatures before burning them to a DVD or writing them to a USB drive.
What does it mean to verify an ISO: integrity and authenticity
When you verify an ISO standard, you're not performing a single check, but two distinct checks that shouldn't be mixed: the file integrity and the authenticity of its originIntegrity tells you if the ISO you have on disk is identical to the one that was on the server, bit for bit. Authenticity tells you if that ISO and its checksums actually come from the project they claim to represent.
Integrity is verified through a hash function (checksum) calculated on the entire fileIf the result you get on your computer matches the one published by the distribution, it means that the ISO has not been altered during download or damaged in storage.
Authenticity is validated through GPG digital signatures associated with developers' public keysIn practice, the distribution signs the file containing the checksums (for example, SHA256SUMS) and you verify that this signature corresponds to the official project key and that it has not been modified.
Although many people only check the MD5 or SHA checksum and consider it valid, if someone has compromised the download server, they could also... Replace the ISO and publish a fake checksum.Therefore, good practice involves also validating the GPG signature of the sums file.
What is a checksum and why is it used in ISOs?
A checksum is the result of applying a checksum to a file. cryptographic hash function that generates a unique string for that content. That string is usually represented in hexadecimal (characters 0-9 and af) and has a fixed length, regardless of the size of the original file.
In the context of GNU/Linux distributions, checksums are used to verify that the data has not changed since the project published the imageIf two files produce the same hash using the same algorithm, they are considered (in practice) to be identical. If the hash doesn't match, a single different bit is enough to completely change the value and allow us to detect the problem.
There are many hash algorithms, but the ones you'll most often see associated with ISOs are: MD5, SHA-1 and the SHA-2 family (SHA-256, SHA-384, SHA-512…)On download pages for Debian, Ubuntu, Fedora, or other distributions, they often offer, alongside the ISOs, files with names like MD5SUMS, SHA1SUMS, or SHA256SUMS.
The procedure is simple: you download the ISO and its hash file, calculate the ISO hash on your machine and You verify that the result matches the value published in the checksum fileIf it matches, you can be reasonably sure that the image is not corrupted or truncated.
MD5 is considered an algorithm today obsolete for heavy-duty security usesbecause practical collisions have been found. Even so, it remains useful for basic integrity checking. For large downloads, especially ISOs, it's better to use... SHA-256, which is currently the recommended standard. in most distributions.
Types of files you will find when downloading an ISO
When downloading a distribution from its official server, it's common to find, in addition to the image itself, a series of extra files. Each one has its purpose, and it's important to know what they are. What function does each type of file perform and how does it relate to verification? that you are going to do.
You'll usually find something like this (names may vary slightly between distros):
- distribution-name-version-architecture.isoThe image itself, which is what you will burn to a USB drive or DVD. For example, ubuntu-20.04-desktop-amd64.iso, which indicates the distribution, version, edition (desktop/server), and architecture.
- MD5SUMS: A text file that includes a list of MD5 hashes for the images available in that directory. Each line associates a hash with a filename.
- MD5SUMS.gpg: GPG signature of the MD5SUMS file, generated with the developers' key. It serves to verify that the MD5 hash file actually comes from the project and has not been altered.
- SHA256SUMS: equivalent to MD5SUMS but using the SHA-256 algorithm. This is the file you should prioritize if it is available.
- SHA256SUMS.gpg: SHA256SUMS GPG digital signature, used to guarantee its authenticity.
In some distributions you'll also see SHA1SUMS, SHA512SUMS, or similar files. They all follow the same principle: a list of sums and, optionally, an associated GPG signature so you can verify that the list has not been tampered with.
If instead of downloading the ISO via HTTP/HTTPS you do it using BitTorrent, most clients already integrate a verification system Internal processing is based on pieces and partial hashes, so the chances of ending up with a corrupted ISO are greatly reduced. Even so, if you want to be absolutely sure of its authenticity, it still makes sense to verify the GPG signature of the hash file.
How hash functions work (MD5, SHA-1, SHA-256…)
On a practical level, you don't need to understand the mathematics behind hashes, but it is helpful to grasp a couple of basic concepts to have a clear understanding. Why are they so useful for checking ISOs?A cryptographic hash function takes a file of any size and returns a fixed-length string; changing a single bit of the file results in a completely different hash.
The requirements for a good hash function include that it is easy to compute in one sense, but virtually impossible to investthat it is very difficult to find two different files with the same hash (collision) and that it is resistant to attempts to generate malicious content that fits a specific hash.
MD5 was for years the de facto standard for this type of verification, but advances in cryptography have shown that It is possible to build different files with the same MD5 hashTherefore, although it remains common practice in some projects, for security reasons it is recommended to use more robust algorithms.
SHA-1 improved upon some of MD5's weaknesses, but collision problems have also been identified and it is considered Not suitable for new implementations requiring high securityThe SHA-2 family (especially SHA-256) is currently the most balanced option between security and performance for ISO verification.
In practice, if the distro offers several sum files, the best option is to choose one. SHA-256 or SHA-512 as the first optionLeave SHA-1 only for cases where there is no other option and relegate MD5 to a basic integrity check when you have no alternative.
Linux tools for calculating and verifying checksums
The good news is that you don't need to install anything unusual: most modern GNU/Linux distributions already include them. command-line utilities for calculating and verifying hashesThese tools are usually part of coreutils or other basic packages.
The most common commands you'll encounter are:
- md5sum: calculates and verifies MD5 sums.
- sha1sum: calculates and verifies SHA-1 sums.
- sha256sum: calculates and verifies SHA-256 sums.
- sha512sum: calculates and verifies SHA-512 sums.
Using them is very straightforward. If you want to calculate the hash of a specific file, simply run the following command in the terminal, from the directory where you have the ISO file:
cd Descargas
sha256sum nombre-de-tu-imagen.iso
The command will print a line with the hash and filename, which you can compare to the value published on the website. If you prefer MD5 or SHA-1, the The command format is identical, changing the utility (md5sum, sha1sum, sha512sum…).
In addition to calculating individual hashes, these same tools allow you to verify multiple files at once using the check mode with the -c optionThat's where the MD5SUMS or SHA256SUMS file that you downloaded along with the ISOs comes into play.
Checking the integrity of an ISO using sum files
In a typical scenario, you download both the ISO image and its SHA256SUMS file (and, if available, MD5SUMS or SHA1SUMS) from the distro's official website. The structure of this file is very simple: each line contains a hash, a space, optionally an asterisk or additional space, and the filename.
To check the ISO with the sum file, you just need to go to the folder where you have both the image and the SHA256SUMS file and run:
sha256sum -c SHA256SUMS
The utility iterates through all the SHA256SUMS lines and compares the hash it calculates locally for each listed file with the one in the document. If everything is in order, it will display something like:
nombre-distro.iso: OK
In case of discrepancies, whether because the ISO is corrupt or because The file does not match the list of sumsYou'll see messages like this:
nombre-distro.iso: FAILED
sha256sum: WARNING: 1 computed checksum did NOT match
The same procedure applies to MD5 and SHA-1 by substituting the corresponding tool and file, for example:
md5sum -c MD5SUMS
sha1sum -c SHA1SUMS
This approach is especially convenient when downloading multiple ISOs or multiple files at once, because You verify all the files at once with a single command. and the system tells you which ones have passed the test and which ones haven't.
GPG Signatures: verifying the authenticity of the sums
So far we have only talked about integrity, but the second component is missing: make sure that the sums file actually comes from the project and not from someone who has compromised the server. That's where GnuPG (gpg) comes in, the standard tool for handling public-key cryptography in GNU/Linux.
Most major distributions sign their hashsum files (e.g., SHA256SUMS.gpg) with a private key associated with the developers. You, as a user, download that signature and use it. the project's public key to verify that the SHA256SUMS file has not been modified.
The typical workflow with a distro like Ubuntu would be this, once you have gpg installed and are in the downloads directory:
gpg --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS
If your computer already has the Ubuntu public key correctly imported and trusted, gpg will display a message indicating a valid signature and key identifierBut it's very common that the first time you run it, it will tell you that it doesn't know that public key.
In that case, the next step would be to import the public key from a trusted key server. For example, with Ubuntu you could do something like this:
gpg --keyid-format long --keyserver hkp://keyserver.ubuntu.com --recv-keys 0xD94AA3F0EFE21092
This downloads the key with the specified identifier from the official keyserver. Once imported, you run the signature verification command again using SHA256SUMS, and you should now obtain a confirmation that the signature is correct and is associated with the key “Ubuntu CD Image Automatic Signing Key (2012) "or another similar one depending on the distro."
GPG may display warnings such as "There is no indication that the signature belongs to the owner," which basically means that You haven't marked that key as absolutely trustworthy.It's not a fatal error: as long as you have verified through other means (official website, documentation, etc.) that the key fingerprint is the one declared by the project, you can proceed.
Practical example: verifying a recent Ubuntu ISO
To understand this clearly, imagine downloading an Ubuntu ISO (for example, a recent LTS version) from the official website. On that page, you'll find links to the ISO, the SHA256SUMS file, and its SHA256SUMS.gpg signature, all in the same or nearby directory.
The steps you would follow would essentially be the following:
First, Download the appropriate ISO for your architecture (for example, the 64-bit AMD64 desktop image), in addition to the SHA256SUMS and SHA256SUMS.gpg files corresponding to that version.
Next, with gpg installed on your system, you would verify the signature of the sums file with:
gpg --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS
If gpg tells you that it cannot find the key, you can obtain it from a key server associated with the project by running a command similar to:
gpg --keyid-format long --keyserver hkp://keyserver.ubuntu.com --recv-keys 0xD94AA3F0EFE21092
Once the key has been imported and the SHA256SUMS file signature validated, you can then check the ISO against that list using:
sha256sum -c SHA256SUMS
The command will check all entries and display a message for each listed file. For the newly downloaded ISO, you should see something like this: “ubuntu-XX.XX-desktop-amd64.iso: Sum matches” or “OK”, confirming that the local image matches exactly the one published by the developers.
Manually check a single checksum
Sometimes you don't have the complete sums file or you've only been given a single hash on the download page. In that case, you can also perform the "old-fashioned" verification. calculating the local checksum and comparing it manually with the published value.
Imagine you've downloaded a Red Hat ISO and the website only shows the SHA-1 hash of that image. In your working directory, you run:
sha1sum redhat7-x64.iso
The command will return something like:
2ac2f3368e6c9fe4d7201d85ad85528698aeaf08 redhat7-x64.iso
From there, you just have to compare visually or by copy/pasting that hash Compare the file name to the one shown on the website or in the small text file you downloaded. If they match character for character, the file's integrity is guaranteed; if they differ, you'll need to download it again.
Verify many ISOs at once
There are situations where you're going to download several images at once (for example, different versions or architectures) and you don't want to check them one by one. Luckily, MD5SUMS, SHA1SUMS, or SHA256SUMS files usually group them together. all the sums of a directory in a single document, just so you can do the bulk verification in one step.
Suppose you have six different ISOs in a folder and you've downloaded the MD5SUM, SHA1SUM, and SHA256SUM files. For MD5 checks, you would do something like this:
md5sum -c MD5SUM
The output will list each ISO along with "OK" or "FAILED" depending on whether the sum matches or not. The same applies to SHA-1 and SHA-256, only changing the tool and the file:
sha1sum -c SHA1SUM
sha256sum -c SHA256SUM
If you ever intentionally modify an ISO, or if it becomes corrupted due to a disk failure, you will see that Only that specific entry marks FAILED While everything else remains OK, the programs will alert you with a message such as "WARNING: 1 computed checksum did NOT match," so you know something has gone wrong.
How to generate your own checksum files
In addition to verifying what others post, you can also create your own checksum files if you plan to share ISOs or any other type of file with more people. It's as simple as using the same tools, but redirecting standard output to a file which you can then upload along with the downloads.
For example, if you have prepared several ISO images in a directory and want to generate an MD5SUM file with all of them, you could do the following:
md5sum *.iso > MD5SUM
The command will scan all the ISOs in the folder and save the list of hashes and names to the MD5SUM file. Similarly, you can create documents using SHA-1 or SHA-256:
sha1sum *.iso > SHA1SUM
sha256sum *.iso > SHA256SUM
By publishing these verification files along with your files, anyone will be able to run md5sum -c, sha1sum -co sha256sum -c on them and verify that the downloads have gone well and that no one has altered them in transit.
If you want to go a step further and offer guarantees of authenticity, you could even digitally sign those sum files Using your own GPG key, similar to how large projects do it. This way, whoever receives the material can verify not only that the data is complete, but also that it truly comes from you.
Adopting the habit of checking checksums and GPG signatures before installing a Linux distribution takes very little time and in return provides an important layer of security, preventing installations with corrupt or manipulated ISOs and helping you detect problems before they affect your computer.
