Ubuntu 26.04 Tutorial / Download and Verify an ISO with Checksums and GPG

Download an Ubuntu 26.04 ISO through an official distribution route, then check it using SHA256SUMS and SHA256SUMS.gpg from the same release location. A digital signature verifies the checksum list's signer, while a SHA-256 comparison checks that the downloaded ISO matches that list; complete both checks as separate steps.

Prepare the ISO, checksum list, and signature

An ISO is a disk image containing installation media. In a conventional VM, attach it to a virtual optical drive. Creating bootable USB installation media for a physical PC requires a separate image-writing process: downloading the ISO alone does not make a USB drive bootable.

Choose 26.04 LTS and the architecture through the Ubuntu Server download page. The amd64 example is ubuntu-26.04.1-live-server-amd64.iso. For another architecture or point release, use the actual filename and verification files from its distribution directory.

1. Create a working folder, such as ubuntu-26.04-verify in Downloads, and save your chosen ISO there.
2. Download SHA256SUMS and SHA256SUMS.gpg from the official directory containing that ISO and place them in the same folder. The amd64 example is in the official 26.04 release directory.
3. Show file extensions if they are hidden. Check that the checksum file was not saved as SHA256SUMS.txt or an HTML page, and that the ISO is no longer a partial download.

Files ending in .torrent or .zsync assist downloading; they are not the ISO. Checksums from a different release or image directory can reject a perfectly intact 26.04.1 ISO because the files do not correspond. Keeping the three files together simplifies the workflow, but you still need to confirm that they belong together.

Preserve the downloaded bytes of the checksum list and signature. Saving them through a text editor can change line endings or encoding and break signature verification. Reading a file and saving an edited copy are different operations.

Understand hashes and digital signatures

SHA-256 calculates a fixed-length hash from a file's byte contents. Matching an ISO's actual hash against a trusted expected value checks that the contents agree. A hash comparison alone cannot establish authenticity if an attacker replaced both the ISO and the checksum list.

SHA256SUMS.gpg is a detached signature over the checksum list. Use GnuPG's gpg command to verify it, compare the public key's full fingerprint with Ubuntu's official instructions, and then compare the ISO checksum. Identifying the signer and checking file contents serve different purposes. Do not conclude that a file is official simply because its hash matches an unverified list. See Ubuntu's download verification tutorial for the underlying procedure.

Prepare GnuPG and a separate public-key directory

Signature verification requires GnuPG. On an existing trusted Ubuntu system, check for it with command -v gpg; if it is absent, install it from the official repositories with sudo apt install gnupg. On Windows, use a trusted GnuPG distribution such as the official Gpg4win package, then confirm that gpg --version works in a new terminal. Avoid unrelated executable downloads found through search.

Run the following GPG commands with the working folder as your terminal's current directory. Both Windows PowerShell and a Linux shell can invoke the external gpg program once it is installed and available. First create an empty directory named ubuntu-verify-keys inside the working folder. On Linux, use mkdir -m 700 ubuntu-verify-keys; on Windows, you can use File Explorer's New folder action. If that directory already exists, choose a fresh name and adjust every command accordingly.

A separate key directory keeps this verification task apart from your usual public-key store. Do not place private keys or login passwords in it. The fingerprint below identifies the Ubuntu CD Image Automatic Signing Key (2012). Compare the full fingerprint with Ubuntu's official instructions rather than trusting a matching display name or short key ID.

gpg --homedir ./ubuntu-verify-keys --keyserver hkps://keyserver.ubuntu.com --recv-keys 843938DF228D22F7B3742BC0D94AA3F0EFE21092
gpg --homedir ./ubuntu-verify-keys --fingerprint 843938DF228D22F7B3742BC0D94AA3F0EFE21092

Compare all 40 hexadecimal characters with the official fingerprint. Spaces below are only for readability.

8439 38DF 228D 22F7 B374  2BC0 D94A A3F0 EFE2 1092

A keyserver supplies public keys; receiving a key from it does not itself establish the owner's identity. If the signing key changes, or a different key signed the file, recheck Ubuntu's current official verification instructions. Do not simply import whatever ID appears in an error message to force the check to pass.

Verify the checksum list's signature

gpg --homedir ./ubuntu-verify-keys --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS

The first argument is the detached signature; the second is the checksum list that was signed. Look for Good signature and check the signer's details and fingerprint. Immediately inspect the exit status as well: run printf 'exit=%s\n' "$?" in a Linux shell or $LASTEXITCODE in PowerShell and check for 0. Output language and signature dates can differ.

A separate key store may produce a warning such as This key is not certified with a trusted signature. This is different from BAD signature, which reports a cryptographic signature failure. Do not dismiss the trust question: confirm that the complete fingerprint matches the official Ubuntu instructions. The GnuPG verify command documentation explains specifying both files for detached verification.

For No public key, check that the required key was imported into the same directory specified by --homedir. For BAD signature, check the pairing of the list and signature and whether an HTML page was saved by mistake, then download both files again from the official location. Do not treat verification against the list as complete while signature verification remains unresolved.

Compare the ISO hash in Windows PowerShell

In File Explorer, open the folder containing the ISO and verification files, then open a PowerShell terminal with that folder as its current location. Confirm the path and files with Get-Location and Get-ChildItem. The following code requires exactly one checksum entry for $isoName and compares all 64 hexadecimal characters without case sensitivity. Match the point-release suffix, live-server designation, and architecture to your actual download.

$isoName = 'ubuntu-26.04.1-live-server-amd64.iso'
$pattern = '^([0-9A-Fa-f]{64}) [ *]' + [regex]::Escape($isoName) + '$'
$entries = @(Get-Content -LiteralPath '.\SHA256SUMS' | Where-Object { $_ -match $pattern })
if ($entries.Count -ne 1) {
    throw 'Expected exactly one matching checksum entry.'
}
$expected = ($entries[0] -split '\s+', 2)[0]
$actual = (Get-FileHash -LiteralPath $isoName -Algorithm SHA256).Hash
if ($actual -ieq $expected) {
    'SHA-256 MATCH'
} else {
    throw 'SHA-256 MISMATCH: do not use this image.'
}

A successful comparison prints SHA-256 MATCH. A missing-entry error suggests a filename or checksum-list mismatch, whereas a hash mismatch means the contents differ. Investigate them separately. The Get-FileHash documentation explains file hashing and algorithm selection.

Compare the ISO hash on Linux

Change into the folder containing the three files and confirm your location with pwd and ls. Check sha256sum --help for support for --check and --ignore-missing. The command below skips listed files absent from the current folder, which is useful when a checksum list includes several image types or architectures.

sha256sum --check --ignore-missing SHA256SUMS
printf 'exit=%s\n' "$?"

Look for ubuntu-26.04.1-live-server-amd64.iso: OK for your selected file and exit status 0. If several ISOs are present, another file's OK result does not establish that your chosen image passed. The command fails when there are no files to verify or when contents differ. It does not automatically verify arbitrary files that are absent from the list.

The Windows and Linux examples are alternative ways to compare an ISO against the same signature-verified list. You do not need both operating systems. However, if you only compared a hash in Windows without checking the GPG signature, you have completed only the hash-comparison step.

Troubleshoot verification failures

Record the original ISO filename, download location, verified signing-key fingerprint, and results. When attaching media to a VM, select the exact file you verified. Writing an image to USB and selecting an installation destination can change data, so verify the downloaded file and identify the installation target as separate tasks.