Is there any way to verify a Ubuntu iso or hashsum via HTTPS?

Question

Neither the ISO nor the hashsum is available via HTTPS. Is there any way to verify you're not getting man-in-the-middled?

score 5 · Answer 1 · answered Mar 01 '16 at 01:47

The hashes and iso's are only provided via http, so md5sum-checking is insufficient. As @Doug Smythies explained in a comment on a deleted answer:

We (the Ubuntu Doc team) no longer maintain the https page, because it is pretty much impossible to do so. The people with the ability to do an https page won't.

However, Ubuntu's gpg fingerprints are available via https here.

TLDR

score 3 · Answer 2 · edited Jan 03 '17 at 06:53

Whilst Canonical isn't providing HTTPS some of the officially recognized 3rd-party mirrors do, so that may be a viable alternative. Even without HTTPS you can always compare the checksums provided by several different mirrors (that you recognize) to help decrease the odds of a MITM (Man In The Middle).

List of Official 3rd-Party Mirrors CAPABLE of HTTPS:

(remove the - from h-ttps, only put there because too many urls)

In future, for those whom don't fancy checking mirrors by hand for HTTPS, you can use Https Finder, which was the tool used to find these mirrors.

score 0 · Answer 3 · edited Apr 13 '17 at 12:23

0

You can download your favorite ubuntu from here: http://www.ubuntu.com/download/desktop

and you can see the md5 checksum from here: http://releases.ubuntu.com/14.04/

Infact 2nd link contains all the .iso and the md5 checksums.

Look for this link for verifying the .iso file

I will suggest go for Ubuntu desktop 14.04 LTS(Long term support).

edited Apr 13 '17 at 12:23

Community

1

answered Feb 29 '16 at 22:14

Ashu

4,004

Is there any way to verify a Ubuntu iso or hashsum via HTTPS?

3 Answers3

TLDR