I've been attempting to install Linux Mint 18 on a hard drive for a while now, but I continuously run into an error when I try to use gpg --verify. The exact error is as follows:

$ sudo gpg --verify sha256sum.txt.gpg sha256sum.txt
gpg: Signature made Thu 30 Jun 2016 05:13:33 AM MDT using RSA key ID A25BAE09
gpg: BAD signature from "Linux Mint ISO Signing Key <root@linuxmint.com>"

UPDATE: Now that I'm retrying all the steps to make sure I did everything correctly, I run into this error when I attempt to import the keys with the commands given on the Linux Mint website, here.

$ gpg --keyserver keyserver.ubuntu.com --recv-key "27DE B156 44C6 B3CF 
D291 300F 846B A25B AE09"
gpg: requesting key A25BAE09 from hkp server keyserver.ubuntu.com
gpg: [don't know]: invalid packet (ctb=22)
gpg: keydb_get_keyblock failed: eof
gpg: [don't know]: invalid packet (ctb=22)
gpg: /home/morsira/.gnupg/pubring.gpg: copy to `/home/morsira/.gnupg
/pubring.gpg.tmp' failed: invalid packet
gpg: error writing keyring `/home/morsira/.gnupg/pubring.gpg': invalid 
gpg: [don't know]: invalid packet (ctb=22)
gpg: keydb_search failed: invalid packet
gpg: key A25BAE09: public key "[User ID not found]" imported
gpg: error reading `[stream]': invalid packet
gpg: Total number processed: 0
gpg:               imported: 1  (RSA: 1)
  • Maybe the signature is, in fact, bad. Though why are you using sudo for gpg? Also, where did you obtain the .txt file from? – grawity Jul 25 '16 at 5:15
  • The website for Linux Mint has .txt and .gpg.txt files that are apparently supposed to be saved in the same directory as the .iso image. I used sudo because I'm pretty terrible at this and thought that it might have some effect. – Morsira Jul 25 '16 at 5:20
  • sudo is utterly not needed for something like this and if your verification fails, then the image could be damaged. Just follow the instructions here on the official Linux Mint page and you should be solid. – JakeGould Jul 25 '16 at 5:36
  • Okay, thank you. One other thing, that may or may not be relevant: when I used sha256sum the checksum matched what the site said it should be in the sha256sum.txt file I downloaded. Why would the results be different when I verified the file? – Morsira Jul 25 '16 at 5:42
  • I can't answer why they would be different (other than your command not doing what you thought it should do), but if you got a matching checksum the other way, there's no way itt would match by chance. So you're good. – fixer1234 Jul 25 '16 at 6:32

There are mainly two ways, you can completely verify a disc's integrity. First you need to verify the checksum. Please follow these steps to verify the checksum:

  1. Run the command below, for your downloaded ISO file to get the checksum.

    sha256sum -b linuxmint-18-cinnamon-64bit-beta.iso
    only edit the downloaded ISO file name while running the command, if yours is different. After running the command you'll find a checksum like this: 8a2d3a3276d36497470156063e02ba894d5b9d562a8edf856dd29ee479eb55c4 *linuxmint-18-cinnamon-64bit-beta.iso

  2. Now you need to open the sha256sum.txt file that you've downloaded from the Linux mint website and make sure if they match. You can normally open the .txt file in any text editor and compare the checksum or use the cat command in Linux. Here is the command:

cat sha256sum.txt

If they match, then this is enough to satisfy that your ISO disc image files are authentic and secure.

Second method: To verify the security signature(gpg), signing key of the disc image, please follow the steps below:

  1. Open a terminal and run this command:

    gpg --recv-key A25BAE09

  2. Now verify the fingerprint by using this command:

    gpg --list-keys --with-fingerprint

    and please check that the fingerprint is:

    Key fingerprint = 27DE B156 44C6 B3CF 3BD7 D291 300F 846B A25B AE09

    uid Linux Mint ISO Signing Key

  3. Now you have to verify the checksum file is correctly signed with the key you just received. Switch to your download folder:

    cd Downloads

  4. Enter this command:

    gpg --verify sha256sum.txt.gpg sha256sum.txt

If it says "Good Signature..." then you're finished. Ignore the warnings that says Key is not certified.

If the above process fails then you can try the whole process by creating your own key. If you need any help please let me know. The above process should work. Thank you.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.