Verifying that a downloaded package or file is genuinely what it claims to be — not tampered with in transit or on a compromised mirror — is a basic but frequently skipped security practice.
# Verify a downloaded file's checksum against a published value sha256sum ubuntu-24.04-desktop-amd64.iso # Compare the output against the checksum published on the official download page # Automated comparison echo "expected_hash_here ubuntu-24.04-desktop-amd64.iso" | sha256sum -c
# A checksum alone only proves the file matches WHAT WAS PUBLISHED - # it doesn't prove the publisher is legitimate. GPG signatures solve that. # Import the publisher's public key gpg --keyserver keyserver.ubuntu.com --recv-keys <KEY_ID> # Verify a signed checksum file against that key gpg --verify SHA256SUMS.gpg SHA256SUMS
Checksums vs Signatures
A checksum alone only confirms the file matches what’s published on that particular download page — if the download page itself is compromised, both the file and its published checksum could be swapped together. A GPG signature, verified against a key obtained through a separate, trusted channel, proves the file actually came from the claimed publisher, not just that it matches whatever happens to be on the page right now.