1

I've been attempting to install Linux Mint 18 on a hard drive for a while now, but I continuously run into an error when I try to use gpg --verify. The exact error is as follows:

$ sudo gpg --verify sha256sum.txt.gpg sha256sum.txt
gpg: Signature made Thu 30 Jun 2016 05:13:33 AM MDT using RSA key ID A25BAE09
gpg: BAD signature from "Linux Mint ISO Signing Key <[email protected]>"

UPDATE: Now that I'm retrying all the steps to make sure I did everything correctly, I run into this error when I attempt to import the keys with the commands given on the Linux Mint website, here.

$ gpg --keyserver keyserver.ubuntu.com --recv-key "27DE B156 44C6 B3CF 
3BD7 
D291 300F 846B A25B AE09"
gpg: requesting key A25BAE09 from hkp server keyserver.ubuntu.com
gpg: [don't know]: invalid packet (ctb=22)
gpg: keydb_get_keyblock failed: eof
gpg: [don't know]: invalid packet (ctb=22)
gpg: /home/morsira/.gnupg/pubring.gpg: copy to `/home/morsira/.gnupg
/pubring.gpg.tmp' failed: invalid packet
gpg: error writing keyring `/home/morsira/.gnupg/pubring.gpg': invalid 
packet
gpg: [don't know]: invalid packet (ctb=22)
gpg: keydb_search failed: invalid packet
gpg: key A25BAE09: public key "[User ID not found]" imported
gpg: error reading `[stream]': invalid packet
gpg: Total number processed: 0
gpg:               imported: 1  (RSA: 1)
7
  • Maybe the signature is, in fact, bad. Though why are you using sudo for gpg? Also, where did you obtain the .txt file from? Jul 25, 2016 at 5:15
  • The website for Linux Mint has .txt and .gpg.txt files that are apparently supposed to be saved in the same directory as the .iso image. I used sudo because I'm pretty terrible at this and thought that it might have some effect.
    – Morsira
    Jul 25, 2016 at 5:20
  • Okay, thank you. One other thing, that may or may not be relevant: when I used sha256sum the checksum matched what the site said it should be in the sha256sum.txt file I downloaded. Why would the results be different when I verified the file?
    – Morsira
    Jul 25, 2016 at 5:42
  • I can't answer why they would be different (other than your command not doing what you thought it should do), but if you got a matching checksum the other way, there's no way itt would match by chance. So you're good.
    – fixer1234
    Jul 25, 2016 at 6:32
  • I more have a problem with the error message that's given when I boot up in the OS. That's the biggest reason why I want to verify my .iso.
    – Morsira
    Jul 25, 2016 at 6:42

1 Answer 1

2

There are mainly two ways, you can completely verify a disc's integrity. First you need to verify the checksum. Please follow these steps to verify the checksum:

  1. Run the command below, for your downloaded ISO file to get the checksum.

    sha256sum -b linuxmint-18-cinnamon-64bit-beta.iso
    only edit the downloaded ISO file name while running the command, if yours is different. After running the command you'll find a checksum like this: 8a2d3a3276d36497470156063e02ba894d5b9d562a8edf856dd29ee479eb55c4 *linuxmint-18-cinnamon-64bit-beta.iso

  2. Now you need to open the sha256sum.txt file that you've downloaded from the Linux mint website and make sure if they match. You can normally open the .txt file in any text editor and compare the checksum or use the cat command in Linux. Here is the command:

cat sha256sum.txt

If they match, then this is enough to satisfy that your ISO disc image files are authentic and secure.

Second method: To verify the security signature(gpg), signing key of the disc image, please follow the steps below:

  1. Open a terminal and run this command:

    gpg --recv-key A25BAE09

  2. Now verify the fingerprint by using this command:

    gpg --list-keys --with-fingerprint

    and please check that the fingerprint is:

    Key fingerprint = 27DE B156 44C6 B3CF 3BD7 D291 300F 846B A25B AE09

    uid Linux Mint ISO Signing Key

  3. Now you have to verify the checksum file is correctly signed with the key you just received. Switch to your download folder:

    cd Downloads

  4. Enter this command:

    gpg --verify sha256sum.txt.gpg sha256sum.txt

If it says "Good Signature..." then you're finished. Ignore the warnings that says Key is not certified.

If the above process fails then you can try the whole process by creating your own key. If you need any help please let me know. The above process should work. Thank you.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .