[SOLVED] unable to verify the sha sum256 txt.gpg Mint 18.3 Cinnamon

[bethm]

Hi I have tried to verify the sha sum256 txt.gpg says no such file or directory, i did verify the other one when it said sorry I am confused now because i did verify one of them, and it imported the key and i verified the correct number before but it did not tell me whether it was good or bad, then later on it says it can't open txt. file then in verifying the signatures that failed, file open error is that because i have already tried to do that?

I am sorry i am trying to download the mint xfce 18.3 cinnamon when it tells me these things and as I am just not sure how I am wondering if i can get help, maybe it is because I am really stressed trying to do 3 things at once, the reason why I don't understand

[slipstick]

It's not clear whether you are using Linux or Windows to do this verification. Of course, different procedures are needed. Perhaps this thread will provide some useful information:

viewtopic.php?f=46&t=268924

[Pierre]

this is the official way to check these ISOs:
https://linuxmint.com/verify.php
but - that is when using a Linux based system.

if you are indeed using a Windows based system, then as mentioned above,
- use Fred's Tutorial:
https://fred-barclay.github.io/VerifyLinuxMint/

[mediclaser]

There is a free straight forward checksum tool if you are to do it under Windows:
https://raylin.wordpress.com/downloads/ ... m-utility/

[slipstick]

this is the official way to check these ISOs:
https://linuxmint.com/verify.php
but - that is when using a Linux based system.

if you are indeed using a Windows based system, then as mentioned above,
- use Fred's Tutorial:
https://fred-barclay.github.io/VerifyLinuxMint/

Fred's tutorial is also for using a Linux based system. For Windows, this is the tutorial:
viewtopic.php?f=42&t=229292

There is a free straight forward checksum tool if you are to do it under Windows:
https://raylin.wordpress.com/downloads/ ... m-utility/

But that only verifies that the downloaded file checksum matches the checksum in the downloaded hash file - it is still necessary to verify that the hash file is properly signed with a valid signature.

[bethm]

Hello again thank you to all that have helped so far I have verified the checksum, and have got the keyserver correct, but i clicked on my iso file and by checksum from there i got the key which is correct but cannot the terminal wont act when i type this in gpg --verify sha256sum.txt.gpg sha256sum.txt can someone help me or do I need to download this file again sha256sum.txt.gpg, and yes I am using mint slyvia 18.3 cinnamon

[bethm]

I have tried this cd
cd ISO
gpg --verify sha256sum.txt.gpg sha256sum.txt

from one page and this from another gpg --verify sha256sum.txt.gpg sha256sum.txt
still nothing happens

[slipstick]

Maybe the easiest way, since you are using linux while trying to verify the iso, is to use a script file like I do. So here is what you need to do:
1. Select a folder for the iso file - I'll assume that you will use the Downloads folder - so put the .iso file to be verified in that folder
2. Create a new document in Downloads and name it LM_iso_verify.sh
3. Copy this script file and save it in the LM_iso_verify.sh document you just created:

Code: Select all

#!/bin/bash

# Save this file in the ~/bin folder (or other convenient locations) as LM_iso_verify.sh
# When you want to check the integrity of the downloaded LMxx.x .iso file:
#
# Download or move your Mint xx.x.iso file to your Downloads folder.
# Move this sumLM18.sh file to the Downloads folder
#  and make sure it is marked as executable.  (Or if you keep it in /home/<your user name>/bin,
#  then it is should already be on the PATH, and you don't need to move it.)
#
# Open a terminal window and cd to ~/Downloads, then
# run the script with "./LM_iso_verify.sh  Mint-xx.x-correct-filename.iso"
# EXAMPLE:   ./LM_iso_verify.sh  linuxmint-18.3-cinnamon-64bit.iso
# or if the script is in /home/bin or otherwise on the PATH, then
# EXAMPLE:     LM_iso_verify.sh  linuxmint-18.3-cinnamon-64bit.iso



# Check for one parameter on the command line (the .iso file name)
if [ $# -ne 1 ]; then
	echo "Usage: $(basename "$0") linuxmint-xx.x-correct-filename.iso"
	exit 1
fi

# Check if that file exists in the working directory and is readable
if [ ! -r "$1" ]; then
	echo "File $1 does not exist or is not readable"
	exit 1
fi

# Importing the signing key (LM18 and higher)
gpg --keyserver keyserver.ubuntu.com --recv-key "27DE B156 44C6 B3CF 3BD7 D291 300F 846B A25B AE09"



# This is for LM18.3 versions - modify these wget lines as needed for other versions
# Download the Mint 18.3 sha256 sum txt files

# If heanet.ie site isn't working, comment out these two lines and uncomment the wget lines for the alternate site
#    or use another alternate of your choice.
wget https://ftp.heanet.ie/mirrors/linuxmint.com/stable/18.3/sha256sum.txt
wget https://ftp.heanet.ie/mirrors/linuxmint.com/stable/18.3/sha256sum.txt.gpg

# University of Oklahoma mirror - an alternate site if above heanet.ie isn't working
#wget http://reflection.oss.ou.edu/linuxmint/isos/linuxmint.com/stable/18.3/sha256sum.txt
#wget http://reflection.oss.ou.edu/linuxmint/isos/linuxmint.com/stable/18.3/sha256sum.txt.gpg




# Verify the signature on the sha256 sum text file
gpg --verify sha256sum.txt.gpg sha256sum.txt
echo "It should report that the signature is Good, $USER."
echo "You can ignore any warning about ...not certified..."
echo "..."

# compare the sha256 sum of your ISO image and the original Mint sha256 sum
echo "Calculating the sha256 sum for $1 and comparing it to the downloaded signed sha256 sum"
echo "Be patient, $USER. I am not that good at math"
echo "..."

# use this if you have Gnu CoreUtils version 8.25 or later
sha256sum --check --ignore-missing sha256sum.txt


echo "Done."

4. Make LM_iso_verify.sh executable - from your file manager you can right click on the file name, select Properties, Permissions, then tick the box "Execute" next to the "Owner" line
5. Open a terminal and cd to Downloads
6. Check that you have the proper files in Downloads by typing ls -la
You should see your iso file and your LM_iso_verify.sh file and this latter one should have the execute bit set in the permissions field.
7. Assuming that the iso file you want to verify is LM18.3 cinnamon, then copy and paste this line into your terminal and hit Enter.

Code: Select all

./LM_iso_verify.sh linuxmint-18.3-cinnamon-64bit.iso

If that is not the name of your iso file, change it in the above command to the correct name.

You should get an output that looks something like this:

Code: Select all

gpg: requesting key A25BAE09 from hkp server keyserver.ubuntu.com
gpg: key A25BAE09: "Linux Mint ISO Signing Key <root@linuxmint.com>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1
--2018-06-20 20:43:12--  https://ftp.heanet.ie/mirrors/linuxmint.com/stable/18.3/sha256sum.txt
Resolving ftp.heanet.ie (ftp.heanet.ie)... 193.1.193.64, 2001:770:18:aa40::c101:c140
Connecting to ftp.heanet.ie (ftp.heanet.ie)|193.1.193.64|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 774 [text/plain]
Saving to: ‘sha256sum.txt’

sha256sum.txt                 100%[=================================================>]     774  --.-KB/s    in 0s      

2018-06-20 20:43:13 (42.6 MB/s) - ‘sha256sum.txt’ saved [774/774]

--2018-06-20 20:43:13--  https://ftp.heanet.ie/mirrors/linuxmint.com/stable/18.3/sha256sum.txt.gpg
Resolving ftp.heanet.ie (ftp.heanet.ie)... 193.1.193.64, 2001:770:18:aa40::c101:c140
Connecting to ftp.heanet.ie (ftp.heanet.ie)|193.1.193.64|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 819 [text/plain]
Saving to: ‘sha256sum.txt.gpg’

sha256sum.txt.gpg             100%[=================================================>]     819  --.-KB/s    in 0s      

2018-06-20 20:43:14 (54.3 MB/s) - ‘sha256sum.txt.gpg’ saved [819/819]

gpg: Signature made Wed 13 Dec 2017 10:16:15 AM CST using RSA key ID A25BAE09
gpg: Good signature from "Linux Mint ISO Signing Key <root@linuxmint.com>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 27DE B156 44C6 B3CF 3BD7  D291 300F 846B A25B AE09
It should report that the signature is Good, steve.
You can ignore any warning about ...not certified...
...
Calculating the sha256 sum for linuxmint-18.3-cinnamon-64bit.iso and comparing it to the downloaded signed sha256 sum
Be patient, steve. I am not that good at math
...
linuxmint-18.3-cinnamon-64bit.iso: OK
Done.

Don't worry about the line that says "Not verified with a trusted signature....."

(Note - credit to forum member austin.texas for the original script file that this is based on.)

[bethm]

Thanks Slipnot-steve I will go more into it tomorrow morning and let you know then, I don't know what I would do if it weren't for you guys help on the forum, where as I used to go to launch pad for help years ago

[mediclaser]

...

There is a free straight forward checksum tool if you are to do it under Windows:
https://raylin.wordpress.com/downloads/ ... m-utility/

But that only verifies that the downloaded file checksum matches the checksum in the downloaded hash file - it is still necessary to verify that the hash file is properly signed with a valid signature.

Wow, I didn't even realize the importance of that until now. That explains the existence of those extra files I've been ignoring.

Anyways, thanks to bethm for creating this thread. I have just learned something new.

[bethm]

...

There is a free straight forward checksum tool if you are to do it under Windows:
https://raylin.wordpress.com/downloads/ ... m-utility/

But that only verifies that the downloaded file checksum matches the checksum in the downloaded hash file - it is still necessary to verify that the hash file is properly signed with a valid signature.

Wow, I didn't even realize the importance of that until now. That explains the existence of those extra files I've been ignoring.

Anyways, thanks to bethm for creating this thread. I have just learned something new.

Hi Mediclaser, no I am not using windows,
thanks for your help.

[bethm]

Hello again I found one issue first of all I didn't have shasum installed so that was installed by the terminal, so in verifying the signature sha256sum,txt.gpg it suggests that there is a file open error and that it can't very the signature, every thing was verified but this, it is driving me mad, please could someone help
so what else can i do i have already downloaded the txt and the gpg file for the sha2156sum again

[JerryF]

Try starting here:

https://linuxmint.com/verify.php

Easy to follow instructions.

[bethm]

hi Jerry,
thanks but I have tried all of that still says can't open and verifying signature failed

[JerryF]

Which version of Mint are you using as of now?

[slipstick]

Yes, we need the answer to JerryF's question (though you did indicate in an earlier post that you are using LM18.3 cinnamon). We also need to be sure about which version you are attempting to verify - is it LM18 or LM 19 and which desktop version - cinnamon, MATE, KDE, or xfce, and 64-bit or 32-bit?

[bethm]

Hi Jerry I am using linuxmint 18.3 cinnamon slyvia

[bethm]

sorry and 32 bit

[bethm]

Hi again slipstick,
I tried that stuff that you advised me to but I am not sure because It says error whether that means that the error is mine and that i didn't complete one of the steps or what
I named the mint file and set it to execute but as I changed name to linuxmint-18.3-xfce-32bit_iso_verify.sh as it the same as what I downlaoded from the mirror is this correct?

and when i tried to verify the sha256sum txt.gpg it said error and it couldn't verify the signature

those iso files are in my downloads /home/my name/dowloads by the way

[bethm]

and attempting to verify mint cinnamon 18.3 xfce 32 bit