Check Linux Mint ISO File for Integrity and Authenticity

A user who may want to install Linux Mint Operating System would follow an installation process as per his choice such as installing it as a single host system or as a dual boot host system alongside another host system or inside another operating system as a guest operating system. For following any of these methods the user would be required to download ISO image file of Linux Mint Operating System. It is recommended to download the latest version ISO file to avail benefits of latest features and check the downloaded Linux Mint ISO for errors before installing the OS.

The ISO image File of latest version should always be downloaded from the official website of Linux Mint Operating System https://linuxmint.com. In some cases, it may be possible that the ISO file may be corrupted while downloading or it may have been tampered while the file was being downloaded over network, or it may be possible that you have sourced the ISO file from some other unreliable source. In any case, the user must assure himself that the ISO you are using is error free and authentic i.e. exactly the same copy as provided by Linux Mint.

Thus, it is very important for the user to verify the Integrity and Authenticity of the ISO file that is going to be used for installation of latest version of Linux Mint Operating System. Thus, the user must check Linux Mint ISO file before proceeding.

What is Integrity and Authenticity?

Integrity: Integrity means that the ISO image file was properly downloaded and that the local file is an exact copy of the file present on the download servers. An error during the download could result in a corrupted file and trigger random issues during the installation.

Authenticity: Authenticity means that the downloaded ISO image was signed by Linux Mint, and thus it isn’t a modified or malicious copy made by somebody else.

We will use Linux Mint recommended method to verify the Integrity and Authenticity of the downloaded ISO file as described in following 07 (seven) easy steps:

Step 1: Download ISO Image File

Login to your Windows or Linux System and open a web browser. Navigate to download page on Linux Mint’s Official website. The Download Page on Linux Mint official website provides various options to download ISO image file for different editions (Cinnamon, Mate or XFCE) and architectures (32-bit and 64-bit). You may choose the edition and architecture as per the configuration of your computer. If you are not sure which Edition or Architecture of Linux Mint to choose you may refer Linux Mint: A summary of Editions.

Click on the corresponding Architecture link as per chosen Edition once you are sure about the Edition and Architecture of Linux Mint to download. To download the Linux Mint ISO image file, choose the download mirror nearest to your geographical location to experience faster download experience with minimum download time.

Save the ISO file on your computer at an appropriate location where you have enough free space of at least 2 GB and wait for the download to finish till complete ISO file is downloaded on your computer.

Step 2: Download SHA256 Sum and Signing files

Re-open the web browser page from which the download mirror was clicked. Click on “verify your ISO” link provided in the “Information about this edition” table. The browser will navigate to Verify Page. Scroll down the verify page and select the version you have downloaded ISO of Linux Mint. Mostly it will be latest version.

Save the ‘sha256sum.txt’ and ‘shasum256.txt.gpg’ files on your computer in same location where the ISO file was downloaded.

Details of the files:

FILE	DESCRIPTION
sha256sum.txt	This file contains the SHA256 sum to check the integrity of the ISO image.
sha256sum.txt.gpg	Signed by the Linux Mint team to check the authenticity of the sha256sum.txt file.

Step 3: Prepare your system to check Linux Mint ISO:

The verification process would vary and depend on whether you have downloaded the ISO file on Windows or Linux Operating System.

Linux: You do not need to download any external supporting tool and the process of Integrity and Authenticity checks could be performed using built-in commands on Linux Operating System.

Windows: You would need to download and install GnuPG tool from its official website https://www.gnupg.org for Windows Operating system. You should download the Simple Installer for the current version of GnuPG tool from GnuPG Binary Releases Section on Download Page. Download Simple installer for the current version of GnuPG, save the installer file to your computer and install GnuPG with default options by executing the GnuPG installer file.

Step 4: Open Application to execute verification commands to check Linux Mint ISO

Linux: Open Terminal by Right Click on the download location and select ‘Open in Terminal’ or open it from applications menu and change the present working directory to Download Directory where Linux Mint ISO, ‘sha256sum.txt’ and ‘shasum256.txt.gpg’ files were downloaded.

Windows: Press ‘Shift’ key and Right Click on the download location and select the option ‘Open PowerShell Window here’. This option would not be available in normal right-click context menu and would only appear when right click is pressed with shift key as shown in below image:

Alternatively, you can also search in Windows Application Menu (as shown in below image) and open the PowerShell and change the present working directory to Download Directory where Linux Mint ISO, ‘sha256sum.txt’ and ‘shasum256.txt.gpg’ files were downloaded.

Step 5: Run SHA256 sum generation command

Linux: In Linux Operating System use ‘sha256sum’ command as per following syntax, options and example:

Syntax: sha256sum -<options> <filename>

For example:

sha256sum -b linuxmint-20-cinnamon-64bit.iso

Windows: In Windows Operating System the sha256sum command is provided through GnuPG tool which must already be installed before opening the Windows PowerShell. If you have opened PowerShell without installing GnuPG tool then close the PowerShell, install GnuPG tool and re-open PowerShell as mentioned in earlier step. The sha256sum can be generated by using the following command as per given syntax, options and example:

Syntax: CertUtil -<options> <filename> AlgorithmName

For example:

CertUtil -hashfile ./linuxmint-20-cinnamon-64bit.iso SHA256

The above commands will generate the SHA256 Sum of Linux Mint ISO file. It may take some time as the file size is too large ~1.8 GB.

Step 6: Check Linux Mint ISO File’s

Integrity

Open a sheet (Microsoft Excel sheet in Windows or Libre Office Calc sheet in Linux) to compare the SHA256 sum and label the cells to identify each SHA key viz. the one generated by GnuPG in Powershell / Terminal and second that is provided in sha256sum.txt downloaded from Linux Mint official website.

Open sha256sum.txt file and copy SHA256 sum for the version of Linux Mint of which the ISO file was downloaded. The sha256 sum for all the editions and corresponding Architectures are provided in this file. Choose and copy the key provided for your version of ISO file. Switch to Excel / Calc sheet to paste the copied sum value. In one cell (Let’s say E1) paste the sum copied from sha256sum.txt file and in another cell (Let’s say E2) paste the sum generated in Powershell / Terminal. Ensure that both sums are in same format and of same length.

Now use the ‘=’ (equal to) operator to compare the value of both cells. For e.g. type ‘=E1=E2’ in another cell. If both values will match the result will be ‘True’ else the result will be ‘False’.

If the result is ‘True’, the integrity of the file is verified to be maintained while downloading from the source as shown in following image:

Else if the result is False, you should download the ISO file again preferably on a reliable computer and Network.

Note: Libre Office is an open source Office Software Suite and can be installed on both Linux and Windows Operating System free of cost. Libre Office Package provides software with similar functionalities as provided by Microsoft Office Suite.

Step 7: Check Linux Mint ISO File’s Authenticity

If the Integrity check was successful, proceed further to check Linux Mint ISO file’s Authenticity. To check Authenticity of ‘sha256sum.txt’ file, import the Linux mint signing key by using the ‘gpg’ command with ‘keyserver’ and ‘recv-key’ options as provided on Linux Mint verify Page:

Command 1:

gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-key "27DE B156 44C6 B3CF 3BD7 D291 300F 846B A25B AE09"

Copy the above command and paste in Powershell / Terminal to import Linux Mint Signing Key. Once, the Linux Mint Signing Key is successfully imported, verify the keys by using the ‘gpg’ command with ‘verify’ option as provided on Linux Mint verify Page:

Command 2:

gpg --verify sha256sum.txt.gpg sha256sum.txt

Copy the above command and paste in Powershell / Terminal. The command should generate a message mentioning ‘Good signature from Linux Mint ISO Signing Key <root@linuxmint.com>’. The good signature message received as an output of verify command is the desired output as per official Linux Mint website.

Next, match the signing key mentioned on Linux Mint website and the one imported in Powershell / Terminal. The signing keys shall be compared in Excel / Calc sheet by copying from Powershell / Terminal and website.

Copy the signing key from Powershell / Terminal and paste in Excel / Calc sheet at designated cell (Let’s say G1). Next, copy the signing key from Linux Mint website and paste in Excel / Calc sheet at designated cell (Let’s say G2). Ensure that both keys are in same format and same length. There may be case where one of the keys may be of greater length. This could possibly be due to extra blank space in one of the keys. Look out for any extra blank space and remove it as Linux Mint officially recommends to compare the keys with or without blank spaces.

Now use the ‘=’ (equal to) operator to compare the value of both cells. For e.g. type ‘=G1=G2’ in another cell. If both values will match the result will be ‘True’ else the result will be ‘False’.

If the result is ‘True’, the Authenticity of the file is verified to be maintained while downloading from the source as shown in following image:

Else if the result is False, you should download the ISO file again preferably on a reliable computer and Network.

Watch out the recorded demonstration of above process in following videos:

a. Check Linux Mint ISO File’s Integrity and Authenticity downloaded on Windows

b. Check Linux Mint ISO File’s Integrity and Authenticity downloaded on Linux

Since you must by now be assured of Integrity and Authenticity of the files downloaded you may proceed ahead to write this file on a DVD or a Flash Drive to make it Bootable and install latest version of Linux Mint. You may check out one of the suitable methods mentioned below as per your requirement to create Bootable media for Linux Mint:

a. Create Linux Mint Bootable DVD on Linux Mint

b. Create Linux Mint Bootable Flash Drive on Linux Mint

c. Create Linux Mint Bootable DVD on Windows

d. Create Linux Mint Bootable Flash Drive on Windows

e. Create Linux Mint Bootable DVD on Ubuntu

f. Create Linux Mint Bootable Flash Drive on Ubuntu