[Bug 1594563] [NEW] Missing checksums for 16.04 network install media

[Thomas Mayer]

Public bug reported:

When I choose network install in the alternative downloads section on
the ubuntu home page, I get forwarded to

http://archive.ubuntu.com/ubuntu/dists/xenial-updates/main/installer-
amd64/current/images/netboot/

Note that this is a http link, so the download is untrusted at this
point.

I can't find trustworthy checksums which available via https on a page
from ubuntu.

The checksums of the iso I downloaded are:

md5sum mini.iso
f48aa34ecb041be150ffd3c84f579678  mini.iso
thomas at lat61:~/Downloads$ shasum mini.iso 
66177d7cecfa0eb3c0225752e51851cc4be5777f  mini.iso
thomas at lat61:~/Downloads$ sha256sum mini.iso 
b7d0d22eb0f5aab1d0f2d84bda1e23974200412f6f6d3d717e611e20a9552ef6  mini.iso

Note that I got forwarded to ...dists/xenial-updates/... So maybe the
checksums change from time to time.

I can also see different keys here:
https://help.ubuntu.com/community/Installation/MinimalCD for the mini.iso
http://archive.ubuntu.com/ubuntu/dists/xenial/main/installer-amd64/current/images/netboot/
But I had problems with that version, which is why I want to give the iso from xenial-updates a try.

Please always make at least sha2 and sha256 checksums available for all media downloads.
The checksums must be provided via https on a domain ending with ubuntu.com. Everything else may NOT be considered trustworthy by users.

Related: #1534967

** Affects: ubuntu-website-content
     Importance: Undecided
         Status: New

** Package changed: btrfs-tools (Ubuntu) => ubuntu-website-content

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to btrfs-tools in Ubuntu.
https://bugs.launchpad.net/bugs/1594563

Title:
  Missing checksums for 16.04 network install media

Status in ubuntu-website-content:
  New

Bug description:
  When I choose network install in the alternative downloads section on
  the ubuntu home page, I get forwarded to

  http://archive.ubuntu.com/ubuntu/dists/xenial-updates/main/installer-
  amd64/current/images/netboot/

  Note that this is a http link, so the download is untrusted at this
  point.

  I can't find trustworthy checksums which available via https on a page
  from ubuntu.

  The checksums of the iso I downloaded are:

  md5sum mini.iso
  f48aa34ecb041be150ffd3c84f579678  mini.iso
  thomas at lat61:~/Downloads$ shasum mini.iso 
  66177d7cecfa0eb3c0225752e51851cc4be5777f  mini.iso
  thomas at lat61:~/Downloads$ sha256sum mini.iso 
  b7d0d22eb0f5aab1d0f2d84bda1e23974200412f6f6d3d717e611e20a9552ef6  mini.iso

  Note that I got forwarded to ...dists/xenial-updates/... So maybe the
  checksums change from time to time.

  I can also see different keys here:
  https://help.ubuntu.com/community/Installation/MinimalCD for the mini.iso
  http://archive.ubuntu.com/ubuntu/dists/xenial/main/installer-amd64/current/images/netboot/
  But I had problems with that version, which is why I want to give the iso from xenial-updates a try.

  Please always make at least sha2 and sha256 checksums available for all media downloads.
  The checksums must be provided via https on a domain ending with ubuntu.com. Everything else may NOT be considered trustworthy by users.

  Related: #1534967

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu-website-content/+bug/1594563/+subscriptions