How to check sha256sum of an ISO image (NOVICE WAY)

[jungle_boy]

WINDOWS OS
In windows OS following this instructions:

1-Download and install the application HashTab
2-Open the directory where you downloaded the ISO image (usually the Download folder),
3-Right click on the downloaded ISO image and select Properties from the menu and check the file hashes tab
4- Cancel the hashing in progress and open setting option and check SHA-256, uncheck other options, let the system calculate again the hash
5-Open the sha256sums.txt file address to check the sum of the sha256sum of downloaded image
https://ftp.heanet.ie/mirrors/linuxmint ... 256sum.txt
6- Highlight and copy the corresponding ISO image sha256sum, past in the Hash comparison space
7-The system compares immediately and warns if they match or not.

Done

LINUX MINT OS
In Linux mint environment you can do the following:

1- Open the sha256sums.txt file address to check the sum of the sha256sum of downloaded image (example: linuxmint-18-mate-64bit.iso)
https://ftp.heanet.ie/mirrors/linuxmint ... 256sum.txt

2-Open the terminal in the directory where you downloaded the iso image (usually Download folder)
3-Type in the terminal;

Code: Select all

sha256sum -b linuxmint-18-mate-64bit.iso (example)
Enter

4-Wait for the system generate the sha256 sum of your ISO image, and compare it to the sum present in the sha256sums.txt file
Done

[xenopeek]

Note: this tutorial foregoes verifying that the checksum file itself originates from Linux Mint. The official instructions at https://linuxmint.com/verify.php include that step.

[Proxima]

I think it's also worth adding that under Windows, if you use the (open source) 7-Zip software for your archiving needs, you can generate SHA-256 sum by right-clicking on a file and choosing SHA 256 from CRC SHA sub-context menu.

[jungle_boy]

Good tip, Proxima!
Thanks!

[viking1au]

I think it's also worth adding that under Windows, if you use the (open source) 7-Zip software for your archiving needs, you can generate SHA-256 sum by right-clicking on a file and choosing SHA 256 from CRC SHA sub-context menu.

Way past my level! ---I am not a programmer. Thanks anyway.

[viking1au]

Note: this tutorial foregoes verifying that the checksum file itself originates from Linux Mint. The official instructions at https://linuxmint.com/verify.php include that step.

Very nice; but that is where I started, & I understand it no better now than then. -- Why do they make things so difficult for the novice, who in no way resembles a programmer or a Geek? -- Others keep referring to Windows, assuming I use it, which I do not. (The Microsoft variety at least).

A few attempts have yielded stuff like 'Bad Command' or similar......... I give up!
It is beginning to look as though I will simply have to install the downloaded ISO on a new drive & simply take a punt on it. -- At this rate I will never learn how to check the sha thing. -- Eventually someone may do a tutorial for Mint 18 on youtube, that hopefully I will understand, but it's not happening for me here on this one.---Thanks all for trying, but remember, I am NOT a programmer.

[Moem]

I think it's also worth adding that under Windows, if you use the (open source) 7-Zip software for your archiving needs, you can generate SHA-256 sum by right-clicking on a file and choosing SHA 256 from CRC SHA sub-context menu.

Way past my level! ---I am not a programmer. Thanks anyway.

There's no programming involved. I'll translate it for you, into easy steps.

1) Be on Windows. If you're not, this does not apply.
2) Have 7zip installed. It's archiving software: it can zip and unzip files. It's free.
3) Run 7zip. Browse to the correct file. I'm assuming it's the ISO for Mint 18.
4) Rightclick on that file.
5) From the menu, choose 'CRC SHA'.
6) From the submenu, choose 'SHA 256'.
7) A long string of numbers is generated. That's the SHA-256 sum. Compare it to the one you got from the download site or the sha256sums.txt.

I know you're not on Windows, but does this look doable in principle?

[Proxima]

(...)
3) Run 7zip. Browse to the correct file. I'm assuming it's the ISO for Mint 18.
(...)

I will change the 3) to
3) Browse to the correct file. I'm assuming it's the ISO for Mint 18.
As you don't even need to run 7zip, it adds options to right-click context menu in windows' explorer (although I'm not 100% sure if the most recent installers do that by default).

[Moem]

Ah! Even simpler than I thought! I'm not running Windows, so I couldn't check, thanks for the correction.

[phd21]

Hi "viking1au", & Everyone Else,

I just read this post and the good replies to it. Here are my thoughts on this as well.

There have been numerous posts in this forum, and elsewhere, on this topic on how to verify that the Linux Mint installation, test drive, disk image files (.iso) are valid files from their original source, so that anyone who uses these file(s) to "test drive" Linux Mint, or who choose to install Linux Mint from these file(s) has a good copy (a non-tampered with copy) from the Linux Mint developers. This all stems from the fact that the Linux Mint websites were "hacked" before and that some of the files and website links were indeed altered before. The Linux Mint team has done a lot to make sure since then, that their website, and their files that you or anyone else downloads and uses are safe.

The Linux Mint files are now safe to download and use, or to install from. So, you do not need to go through the verification steps, unless you want to.

The process of verifying files using "checksum" values has been around for a long time in all operating systems, MS Windows, Mac, and Linux. Most people just do not take the time to verify the checksum values, or know how to do it, which is a little risky.

But as a responsible computer user, it is recommended that everyone, take the time to verify the files they download are from their original source before you use them. There are two generally accepted methods:
1. Verify the current "checksum" value for the downloaded "LinuxMint.iso" file to the checksum value in the checksum file provided by the Linux Mint website, "sha256sum.txt" (checksum file).
and to also
2. Verify the security "Signing Key" signature of the file. Who put the file there, where is the file from, was it the Linux Mint Developer(s) or someone else?

Verifying the "CheckSum" of a file or files is a fairly easy process, verifying the "Signing Key" Signature is a more involved process because you first have to create your own personal Signing Key Signature for comparing, if you do not already have one, and the average user does not have a personal GPG "Signing Key" (AKA Encryption Key Signature). It is not hard to create your personal signing key signature though, and there are other really good benefits to having your own personal "Key Signatures", in addition to verifying downloaded files.

Checksums are used to ensure the integrity of a file after it has been transmitted from one storage device to another.
http://www.online-tech-tips.com/cool-we ... -checksum/

99% of the time verifying (comparing) the "CheckSum" value for a file is more than enough for most people to be comfortable that the file they downloaded is okay to use, by comparing the values in the "checksum" file (sha256sum.txt) from the the website where you downloaded the ".iso" file, to the checksum value you get after you downloaded the file to your system by running some application program that reads the downloaded file and displays the current checksum value of the file. Obviously, the checksum values should match exactly.

There are numerous applications, utility programs, and "command line", or "console terminal command line", options available in all operating systems for doing this, including MS Windows, Linux, and Mac. Command line options are almost always pre-installed, but if you are not comfortable with using the command line options, there are desktop (graphical - gui) options available as well.

Desktop (GUI) Archiving programs like "7Zip" (great), and "PeaZip" (awesome), are available for Linux and MS Windows and they have options to easily calculate the checksum of the downloaded "LinuxMint.iso" file, or any other file, which you can then visually compare to the checksum file that you downloaded from the Linux Mint website. See screen shots below. In Linux, you also have the simple "GtkHash" program available to install and is super easy to use from the Software Manager or Synaptic Package Manager (SPM), just browse to the "LinuxMint.iso" file, click "hash" button in the lower right, wait a little until you see the current file checksum.

"PeaZip" (archiving program) can easily be installed from link below (click easy to install linux ".deb" file, or MS Windows users can use the link on top), and run PeaZIp to calculate the checksum value for a file. PeaZip also integrates with most file managers, so that you can right click an ".iso" file, open with PeaZip, then tell it to get the "checksum" value for the file.
Simple Instructions below:
Click "Test" in the toolbar", then click "CheckSum/hash".
or just run "PeaZip",
Click Tools, PeaUtils, click "Function", select "Hash sha-256", click "select file(s)" & browse to the "iso" file(s), click ok
http://www.peazip.org/peazip-linux.html

Linux Mint website maintainers could have made getting the checksum files much easier for everyone by providing direct links to their checksum files (sha256sum.txt (checksum file), sha256sum.txt.gpg (signature verification file)) directly on their download web pages where everyone usually downloads their copy of Linux Mint that they want to try or install (see link below for this). But, instead you have to click the link "Don't forget to verify your ISO" at the top of the Linux Mint website where you downloaded the ".iso" file, scroll down to "Steps to verify an ISO image", and click "Browse the main mirror, or choose a mirror near you", then you have to know which edition and version of Linux Mint you want to try or install, like "Debian", "Stable", or "Testing". For most people this will be "Stable", so you click that, Then you click the version of Linux Mint that you want to try or use, like version 17.3, or the brand new version 18, and then you right click the checksum file "sha256sum.txt", and save the file (Save Link As), into the same folder as you downloaded the LinuxMint.iso file. This is a lot of clicking, but it is easy to do. Some people here have been kind enough to provide links to the checksum files.

Here is a weblink where you can just click the version of Linux Mint that you want to try or install, and then download (right click save file as) the checksum files, it is called "Index of /pub/linuxmint/images/stable/"
http://mirror.jmu.edu/pub/linuxmint/images/stable/

Once you have downloaded (saved) the original checksum files from Linux Mint website along with the Linux Mint Installation, Test Drive, file (LinuxMint.iso), then you can use one the desktop programs mentioned (or a run command) to find out what the current "checksum" of the downloaded Linux Mint installation (.iso) file is, then use your file manager to right click the original Linux Mint checksum file "sha256sum.txt" that you also downloaded (saved), select "open with text editor" (open as text), and then visually compare the checksum values. If they match, then your file is good. If they do not match, then re-download the Linux Mint ".iso" file, and recheck the checksum values.

If you also want to verify the security "Signing Key" signature of the file, then follow the instructions for that process in the link below.
See section on "Verify security "Signing Key" Signature of the Linux Mint .iso file"
viewtopic.php?f=42&t=226092&p=1192608#p1192608


Hope this helps ...

GtkHash_Checksum_Compare_Cinnamon18-sm.jpg

PeaZip_CheckSum256_Cinnamon18_1sm.jpg

PeaZip_CheckSum256_Cinnamon18_3sm.jpg

[viking1au]

2-Open the terminal in the directory where you downloaded the iso image[quote][/quote]

Well; Image of what? The txt file, the download itself, the great big file of signed key type text? -- Whatever I try I get Bad Command, or not found, or no such file, message.

It is unbelievable that they could make this task so complex & obscure.
Also to find that regardless of noting that I DO NOT HAVE (M.S.) WINDOWS, at all, someone seems to be trying all sorts of methods to get me to do it in Windows. ---What with. --I do not have it!
Have looked for a good tutorial on Youtube but have not yet found one for Linux Mint 18.
I can only assume that many people who have downloaded it are simply "taking a punt" and using it; which tends to throw the 'security' thing out the window.
So far,this just seems totally crazy.

[viking1au]

Well, thanks, at last to PHD21. The (rather lengthy) reply has been bookmarked for future reference, but for the moment, I took a plunge on GtkHash after watching some turkey on youtube who uploaded it. - All 54 seconds of it. -- No talking (may have no English) & like many others these days, lots of muzak designed to make one go totally mindless, so turned the Muzak off.
Still, I got the gist before it had finished, and it also answered another query re my favourite burning software; K3b.... I had noticed when burning an ISO image in K3b, that it presented an MD5 sum in it's main box. -- This sum never agreed with the sha256sum, but my first use of GtkHash helped me understand why. - An MD5sum is different to the sha256, or course. -- GtkHash shows both figures, which, with the MD5sum shown by K3b, gives one more confidence. ---- Got more discs to burn today but will return to the (bookmarked) subject tomorrow. - Did not believe for one instant I would ever be able to mark this subject as solved, but I think it is. --Another point worth noting is that to see the full figures in GtkHash, it is vital to re-size the box horizontally (almost the width of the screen) or hit the 'maximise' button, to see all numbers fully. Thanks. -- Rgds all.

[viking1au]

LINUX MINT OS
In Linux mint environment you can do the following:

1- Open the sha256sums.txt file address to check the sum of the sha256sum of downloaded image (example: linuxmint-18-mate-64bit.iso)
https://ftp.heanet.ie/mirrors/linuxmint ... 256sum.txt

2-Open the terminal in the directory where you downloaded the iso image
3-Type in the terminal;

Code: Select all

sha256sum -b linuxmint-18-mate-64bit.iso (example)
Enter

4-Wait for the system generate the sha256 sum of your ISO image, and compare it to the sum present in the sha256sums.txt file
Done

WINDOWS OS
In windows OS following this instructions:

1-Download and install the application HashTab
2-Open the directory where you downloaded the ISO image (usually the Download folder),
3-Right click on the downloaded ISO image and select Properties from the menu and check the file hashes tab
4- Cancel the hashing in progress and open setting option and check SHA-256, uncheck other options, let the system calculate again the hash
5-Open the sha256sums.txt file address to check the sum of the sha256sum of downloaded image
https://ftp.heanet.ie/mirrors/linuxmint ... 256sum.txt
6- Highlight and copy the corresponding ISO image sha256sum, past in the Hash comparison space
7-The system compares immediately and warns if they match or not.

Done

[Schultz]

I just do it from the terminal. Type in sha256sum then the path to the iso.

Example:

sha256sum /home/name/Downloads/linuxmint-18-mate-64bit.iso

[jungle_boy]

Good, Schultz!
Even easier!

[phd21]

Hi Everyone,

I think the console terminal command below is by far the easiest method to verify the Linux Mint iso file(s) checksum values. It automatically compares the checksum values of the Linux Mint .iso file(s) you downloaded to the Linux Mint checksum file "sha256sum.txt" you also downloaded.

Obviously, make sure you have downloaded and saved your Linux Mint .iso file(s) and the checksum file "sha256sum.txt" into the same folder, like your "/Downloads" folder, then type in, or copy & paste the command below. Tip: If you want to download different versions of Linux Mint, then use different folders (like "~/Downloads/LinuxMint18", or "~/Downloads/LinuxMint-17.3") to store the .iso files and their checksum files because they will be different for different versions, and yet the checksum files have the same name "sha256sum.txt".

~/Downloads> sha256sum --check sha256sum.txt

Code: Select all

sha256sum --check sha256sum.txt

Results will be like that shown below: If the checksum values match on the Linux Mint .iso file you downloaded and are going to use, it just shows "OK". No need to visually (manually) compare the checksum values, or run other programs.

I had the Linux Mint 32 bit editions of Cinnamon and Mate in this folder when I ran the command, and it checked them both and they were "ok". The Linux Mint checksum file "sha256sum.txt" usually has other checksum values for other Linux Mint iso files that you may not have downloaded, and so they are not in the same folder, that is why the results show "No such file" or "Failed to Open or Read" on some lines below, because I did not have those files in the folder; just ignore those.

linuxmint-18-cinnamon-32bit.iso: OK
sha256sum: linuxmint-18-cinnamon-64bit.iso: No such file or directory
linuxmint-18-cinnamon-64bit.iso: FAILED open or read
linuxmint-18-mate-32bit.iso: OK
sha256sum: linuxmint-18-mate-64bit.iso: No such file or directory
linuxmint-18-mate-64bit.iso: FAILED open or read
sha256sum: WARNING: 2 listed files could not be read

The actual contents of this Linux Mint 18 checksum file "sha256sum.txt" (below) has 4 checksum values in it. "Cinnamon" 32-bit & 64-bit and "Mate" 32-bit & 64-bit. Thus, there are 4 responses from the command above.

3fb60a7698f5d80e68526016da3e4455d8a19be6b1cb0eeb5b59dbdd8cf1ffb3 *linuxmint-18-cinnamon-32bit.iso
2238dca5b51f9e2674a7e31c46f19141fbdecff6e44c06ecbc9a7bb59b75a816 *linuxmint-18-cinnamon-64bit.iso
d064397cd185fa4a91fd6db4ff42f105c121a7607691797325323135713a8810 *linuxmint-18-mate-32bit.iso
c634f48b248489eef782067484a04978f046e9ccd507d9df35c798a1db9bef22 *linuxmint-18-mate-64bit.iso

Of course if you really want to see the checksum values, and manually (visually) compare them, use the other methods.


Hope this helps ...

[wanderous]

Hi there,

thanks for all those tips, even though I realise I am too novice to understand every piece of instruction.

Could you also delete from the sha256sum.txt file all the unnecessary lines? Keep only the line of the edition you're going to use?
That way we novices wouldn't be so confused by the "FAILED" messages.

[kbwoodworker]

Although there is reference to the "signing key" above, it is for those who are downloading into linux. I have windows on the computer I use to download linux. I found this excellent tutorial from Polarvortex for those using windows to check using the signing key.
viewtopic.php?f=42&t=229292&p=1214047#p1214047

[phd21]

Hi "wanderous",

Yes, you could edit the sha256sum.txt (text) file to remove the ones you are not using.

Hope this helps ...

[phd21]

Hi "wanderous",

Here is another console terminal command you can run that will "ignore any missing files", so that you do not get any "failed error" messages.

sha256sum --check --ignore-missing sha256sum.txt

Code: Select all

sha256sum --check --ignore-missing sha256sum.txt

Hope this helps ...