A Blog by Expatriotic

Mini-guide: Verifying Software

Tip jar 🫙 expatriotic@walletofsatoshi.com

Donations
Bitcoin paynym = +expatriotic
Monero QR

88D6SZFBA6fFhYGdnY4c57dTAJD6jyqRTfCKwHjZrfdnhd8phAMYnDQWSJrqyAmgVHV7mDU6soaHogZvno1AUXp79DwtWvK

Why you SHOULD verify mission critical software

Verifying your software downloads is a critical, two-step security process. It ensures the file you downloaded is both uncorrupted and authentic.

  1. File Integrity: We check that the file wasn't damaged during download. A single bad bit can corrupt an entire installation.
  2. File Authenticity: We check that the file is the real file from the developer, not a fake version injected with malware by an attacker who may have compromised a download server.

Core Concepts

We use two different cryptographic tools to solve these two problems.

Our flow is simple: First, we verify the signature on the list so that we can trust those hash outputs (fingerprints) that it lists. Second, we verify our software against that now trusted list.

Prerequisite Tools

Before you begin, you need the necessary command-line tools.

Download Files

We will use Ubuntu 24.04 LTS as our example. First, open your terminal (or Git Bash on Windows).

Let's navigate to our Downloads folder and create a new directory for our work. The ~ is a shortcut for your home directory.

cd ~/Downloads
mkdir ubuntu-verify
cd ubuntu-verify

Now, let's download the four files we need. We use curl to do this.

# 1. The software itself (the .iso file)
curl -LO https://releases.ubuntu.com/noble/ubuntu-24.04.3-live-server-amd64.iso

# 2. The list of fingerprints (SHA256SUMS)
curl -LO https://releases.ubuntu.com/noble/SHA256SUMS

# 3. The signature for that list
curl -LO https://releases.ubuntu.com/noble/SHA256SUMS.gpg

# 4. The official Ubuntu keyring
curl -o ubuntu-keyring.gpg "https://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg"

Command Flags Explained:

This last file, ubuntu-keyring.gpg, is our secret weapon. Instead of trying to find the one correct key on a public server (which often fails due to firewalls), we have securely downloaded Ubuntu's entire set of official keys. This is the most reliable method.

If you were downloading a program from a lone dev, I would recommend locating their PGP key somewhere OTHER than the page that the program is to be downloaded from. Manually check their X account or they may store it--as Ashigaru devs do--on keybase.io.

Verify Signature

This is Step 1, where we check that the list was signed by the dev(s).

We will use the gpgv command, a lightweight tool for only verifying signatures. We'll tell it to use the keyring file we just downloaded.

gpgv --keyring ./ubuntu-keyring.gpg SHA256SUMS.gpg SHA256SUMS

Command Explained:

You are looking for this exact output:

gpgv: Good signature from "Ubuntu CD Image Automatic Signing Key (2012) <cdimage@ubuntu.com>"

Note: You may also see a WARNING that the key is "not certified with a trusted signature." This is normal and safe. It simply means you have not personally signed that key. The Good signature message is all that matters. It confirms the file is authentic.

Verify File

This is Step 2, where we check our software's "fingerprint" against the trusted list.

Now that we 100% trust the SHA256SUMS file, we can use it to check our .iso.

# On Linux / MacOS / Git Bash
sha256sum -c SHA256SUMS 2>&1 | grep ubuntu-24.04.3-live-server-amd64.iso

Command Explained:

The only output you should see on your screen is: ubuntu-24.04.3-live-server-amd64.iso: OK

If you see OK, your verification is complete. You have cryptographically proven that your file is authentic and uncorrupted. If you see FAILED or get no output, your file is bad. Delete it and download it again.

CLI Tips

Working in the terminal can be much faster with these tricks.