Phase 1 · Free

1.3 Getting the Installer and Proving It Is Real

Ubuntu comes as one big file called an ISO image. It is the installer, packed the way a DVD would be. You will download it from Ubuntu, then check that the file you got is exactly the file Ubuntu published. Downloads get corrupted. Mirrors occasionally get tampered with.

20 minPhase 1: Get a Machine RunningFree

Phase 1. Lesson 3 of 5. About 20 minutes.

Plain entry

Ubuntu comes as one big file called an ISOA single file that holds an exact copy of an optical disc's contents, used to distribute operating system installers and boot virtual machines. Read more → image. It is the installer, packed the way a DVD would be. You will download it from Ubuntu, then check that the file you got is exactly the file Ubuntu published. Downloads get corrupted. Mirrors occasionally get tampered with. A thirty-second check rules both out.

On the VMA software-based emulation of a complete computer that runs its own operating system and applications, isolated from the host hardware. Read more → path, the ISO is all you need. On the bare-metal path, you also write it to a USB stick.

Terms

  • ISO image: a single file holding the full contents of a disc. VMs can boot from it directly.
  • ChecksumA fixed-length string produced by running a file through a hash function, used to verify the file has not been corrupted or modified. Read more → (hash): a short fingerprint calculated from a file. Change one bit of the file and the fingerprint changes completely. See checksum.
  • SHA-256A cryptographic hash function that turns any input into a fixed 256-bit fingerprint, used to verify downloads, sign certificates, and secure blockchains. Read more →: the hashing method Ubuntu uses for its published checksums.
  • GPGA free tool that uses asymmetric cryptography to sign files and verify their authenticity, confirming both who published a file and that it has not been modified. Read more → signature: proof that the checksum list itself came from Ubuntu. See GPG.
  • Bootable USB: a USB drive with the installer written to it so a real machine can start from it.

Depth

Step 1. Download

Go to https://ubuntu.com/download/desktop and download Ubuntu 26.04 LTSLong Term Support: a software release that receives security and bug-fix updates for an extended period, typically years, without major changes. Read more → for your machine:

The file is several gigabytes. Note its exact name. Since the first point release the download is named ubuntu-26.04.1-desktop-amd64.iso (or -arm64.iso); the examples below use the original ubuntu-26.04-desktop-amd64.iso name, so use whatever name you actually have.

Step 2. Get the official checksum

Every release folder has a file called SHA256SUMS. For 26.04 it lives at https://releases.ubuntu.com/26.04/SHA256SUMS. Open it. Each line is a hash, then a filename.

Step 3. Hash your file and compare

Windows (PowerShell):

Get-FileHash .\ubuntu-26.04-desktop-amd64.iso -Algorithm SHA256

Expected output shape:

Algorithm  Hash                                                              Path
---------  ----                                                              ----
SHA256     3F1A...(64 hex characters)...9C2E                                 C:\Users\you\Downloads\ubuntu-...

macOS (TerminalThe window or screen where you type text commands and read their output, connected to a shell that runs those commands. Read more →):

shasum -a 256 ~/Downloads/ubuntu-26.04-desktop-arm64.iso

Linux:

sha256sum ubuntu-26.04-desktop-amd64.iso

Compare the 64 characters to the line in SHA256SUMS. Case does not matter. Every character must match. If one does not, delete the file and download again.

On Linux or macOS you can let the machine compare for you. Put SHA256SUMS in the same folder and run:

sha256sum -c SHA256SUMS --ignore-missing

Expected output:

ubuntu-26.04-desktop-amd64.iso: OK

Step 4 (bare metal only). Write the USB

You need a USB stick of 8 GB or more. Everything on it will be erased.

  • Windows: Rufus, https://rufus.ie/. Pick the stick, pick the ISO, partition scheme GPT, target UEFI. Start.
  • macOS, Windows, or Linux: balenaEtcher, https://etcher.balena.io/. Flash from file, select target, Flash.
  • Ubuntu: the built-in Startup Disk Creator.

Both tools are free.

Going further: verify the checksum list itself

A checksum only proves your file matches the list. To prove the list came from Ubuntu, check its signature:

gpg --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS

If gpg says it cannot check the signature because it has no public key, follow the key import step in Ubuntu’s tutorial below, then run the command again. You want Good signature from "Ubuntu CD Image Automatic Signing Key". The BytesNation field note on checksums and GPG covers this in depth.

Why it works this way

A hash is a fingerprint of every byte. Change one byte and the hash changes completely, so a match tells you the file you have is the file Ubuntu published. That catches a download cut short, a bad USB stick, and a swapped file on a mirror. The SHA256SUMS list must come from the official site, because a tampered mirror can serve a tampered list too. That is the reason for the “Going further” signature check.

Myth vs fact

Myth: “The checksum matched, so the file is safe.” Fact: A matching checksum proves the file matches the list you compared it to. It does not prove who wrote the list. If the list came from the same place as a bad file, both can be fake and still match. Checking the GPG signature on SHA256SUMS proves the list came from Ubuntu. Ubuntu’s own guide does both steps for this reason.

Self-check

  1. What does a matching SHA-256 hash prove? What does it not prove?
  2. Which ISO do you need for an M2 MacBook?
  3. What happens to existing files on the USB stick when you flash it?

Answers: (1) It proves your file is identical to the one in the list. It does not prove the list is genuine; the GPG signature does that. (2) ARM64. (3) They are erased.

Sources