I want to download and verify the ISO of lubuntu. The problem is I can't find a secure channel in the first place. The official ISO  is being downloaded with http (not https). Of course I can download and then verify the hash, but the only place I can find the hashes is , which is also insecure http. Any way to securely download the ISO?    Edit: The proposed duplicate question is not similar to my case - it talks about downloading using apt, which uses an authentication mechanism (no user action needed). My questions is about files downloaded manually, thus I must authenticate the files by myself.
15860
Are repository updates secure?  As a bear of little brain from the developer side, I cannot understand why the repository list is http://security.ubuntu.com and the other http(unsecured) sites listed in /etc/apt/sources.list.  Without a certificate chain match this appears as "ask any responder for a list of packages to update" instead of "ask the ubuntu.com site..."  Can any network choose to spoof the update sites, and is this a common practice to provide a locally cached and vetted copy?
63741
Concrete issue: The  is at version 1.0.5-1, released in July 2011 according to the .  The recent memory-disclosure vulnerability (, , ) isn't fixed in 1.0.5-1. If I'm not misreading the Ubuntu CVE page, all Ubuntu versions seem to ship a vulnerable nginx.   Is this true?  If so: I thought there was a security team at Canonical that's actively working on issues like this, so I expected to get a security update within a short timeframe (hours or days) through apt-get update. Is this expectation -- that keeping my packages up-to-date is enough to stop my server from having known vulnerabilities -- generally wrong? If so: What should I do to keep it secure? Reading the  wouldn't have helped in this case, as the nginx vulnerability was never posted there.
87751
Have you guys used ? The repository has not yet issued for 16.04 LTS, but besides, it might not be free anymore.  Is anyone watching Acestreams/Sopcast with any other software + where can I find such software?  Thank you!
60810
I have the Ubuntu 11.10 ISO downloaded but I want to install the Wubi for some specific reasons. When I do the click on the Wubi installer, it starts downloading files. Since I already have the ISO with me, is it possible to make use of this ISO during the installation?
36090
I have recently installed ubuntu 11.10. But when i try to install a software it tries to 'updating cache' but after a while, it stops, showing:                            Failed to download repository information                           Check your internet connection   so, now i am totally unable to install any software in my ubuntu.  Please,let me know how to solve the problem.
11619
I am attempting to verify my download of Bionic Beaver on Windows 7.  I feel like I am missing something very obvious.  I went to  and clicked on both SHA256SUMS and SHA256SUMS.gpg  It seems like this does not download the files, but opens the text in the files in new tabs.  I used Ctrl-A and then copied the text into Notepad, naming the files SHA256SUMS and SHA256SUMS.gpg.  I made sure that windows didn't add any weird extensions when saving.  I manually downloaded both keys I used from https://keyserver.ubuntu.com, one with fingerprint  C598 6B4F 1257 FFA8 6632 CBA7 4618 1433 FBB7 5451   and the other with fingerprint  8439 38DF 228D 22F7 B374 2BC0 D94A A3F0 EFE2 1092   After I downloaded both keys I certified them with my personal key using Kleopatra, after verifying the key fingerprint with those at .  When I ran   gpg --verify SHA256SUMS.gpg SHA256SUMS   I got   gpg: Signature made 11/29/18 16:27:43 US Mountain Standard Time gpg:                using DSA key 46181433FBB75451 gpg: BAD signature from "Ubuntu CD Image Automatic Signing Key &lt;cdimage@ubuntu.c om&gt;" [full] gpg: Signature made 11/29/18 16:27:43 US Mountain Standard Time gpg:                using RSA key D94AA3F0EFE21092 gpg: BAD signature from "Ubuntu CD Image Automatic Signing Key (2012) &lt;cdimage@u buntu.com&gt;" [full]   When I ran   gpg --verbose --verify SHA256SUMS.gpg SHA256SUMS   I got  gpg: armor header: Version: GnuPG v1 gpg: Signature made 11/29/18 16:27:43 US Mountain Standard Time gpg:                using DSA key 46181433FBB75451 gpg: using pgp trust model gpg: BAD signature from "Ubuntu CD Image Automatic Signing Key &lt;cdimage@ubuntu.c om&gt;" [full] gpg: binary signature, digest algorithm SHA512, key algorithm dsa1024 gpg: Signature made 11/29/18 16:27:43 US Mountain Standard Time gpg:                using RSA key D94AA3F0EFE21092 gpg: BAD signature from "Ubuntu CD Image Automatic Signing Key (2012) &lt;cdimage@u buntu.com&gt;" [full] gpg: binary signature, digest algorithm SHA512, key algorithm rsa4096   I tried copying the data from SHA256SUMS and SHA256SUMS.gpg tabs over TOR instead, in case it was a local network problem, but no dice either.  What am I missing here? Is there some way to download the SHA256SUMS and SHA256SUMS.gpg files directly, as opposed to copying the data into a text editor and saving it?  Any help would be very appreciated. I am very confused and frustrated at this point.
18172
I'm writing a program that needs to download GPG keys for various distributions to do unattended net installs. To do this securely and in an automated way, I need to download the key via HTTPS, which means "gpg --recv-keys" isn't an option. Other distributions (e.g., Fedora) make their keys available on their websites via HTTPS (e.g., ), but I can't find the Ubuntu key file anywhere on ubuntu.com. Does anyone know where I can get it via HTTPS?
2858
Does apt-get use https or any kind of encryption? Is there a way to configure it to use it?
60883
I have Chromium web browser on my Lubuntu 13.04 (pre-installed).  I use LX Terminal (pre-installed) to write commands. I am trying to download flash player on Chromium using instructions on this :  sudo add-apt-repository ppa:skunk/pepper-flash   After typing in my password, this worked. Now   sudo apt-get update   I didn't need to type in my password, as I continued on the same terminal, but got W:/ and E:/ fetch file errors  sudo apt-get install pepflashplugin-installer   I continued on the same terminal despite the fetch file errors... and they said pepflashplugin-installer could not be found.  Is the last error because of fetch file errors, or because I need to download pepflash-plugin-installer somewhere? Or is it because of something else?  I cannot download the Chrome browser, and not looking to use flash player on my Firefox web browser (installed using lubuntu software center).
1926
Any install that I'm trying through the Software Center is telling me:  Requires installation of untrusted packages: The action would require the installation of packages from not authenticated sources.  I did an apt-get update from the command line, then removed the software sources that the keys were bad from (PPAs I added myself), and unchecked them in the software sources for software center, but to no avail.  I can't install anything from software center anymore - only&gt; from the command line with apt-get. Is uninstalling/installing the only option?  I don't want to break other PPAs that I have. Additional information: Here's a paste from apt-get update: Reading package lists... Done W: GPG error: http://ppa.launchpad.net oneiric Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY B725097B3ACC3965 W: GPG error: http://us.archive.ubuntu.com oneiric Release: The following signatures were invalid: BADSIG 40976EAF437D05B5 Ubuntu Archive Automatic Signing Key &lt;ftpmaster@ubuntu.com&gt;  I've tried apt-key update, and there was no effect (two keys unchanged). The output of apt-get update and apt-get upgrade, and the contents of /etc/apt/sources.list, can be found in .
12852
After doing a man apt-get and cursory Google search it's not clear how I find new programs to install (from the internet) using apt-get (which is amazingly powerful and simple coming from another Linux distro).  I'm using Ubuntu Server 8.04 LTS (an inherited system used for some random work), so no GUI.  Anyone have quick advice here?
42195
I have a lot of iso-files downloaded from internet. I want to check the hash from my Ubuntu 12.04 and 12.10. Is there any application on Ubuntu to check the MD4, MD5, SHA-1, and CRC hash?  I need the CRC hash-checker to check my Windows 8 iso files.
107947
Is there anyway to extract iso or convert it to zip, rar, or tar file? I have a big .iso file on my remote server and I just want a file from it, not all of that; unfortunately I do not have root access, so it's my problem.
37982
Please help me: I added this repositories manually and i cant remove them  echo 'deb http://download.opensuse.org/repositories/home:/Horst3180/Debian_8.0/ /' &gt; /etc/apt/sources.list.d/vertex-theme.list  wget http://download.opensuse.org/repositories/home:Horst3180/Debian_8.0/Release.key   I tried to use removing the key using apt-key list and then removing using the id, it successfully removed the key but when i use apt update i get this output:  W: GPG error: http://download.opensuse.org/repositories/home:/Horst3180/Debian_8.0  Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5A7D1D38BEB6D886 E: The repository 'http://download.opensuse.org/repositories/home:/Horst3180/Debian_8.0  Release' is not signed. N: Updating from such a repository can't be done securely, and is therefore disabled by default. N: See apt-secure(8) manpage for repository creation and user configuration details.   I just want to be able to run apt update normally like when a fresh OS install was made
39631
I am trying to download files from .  The URL is:   When I use this command:  wget http://www.ncbi.nlm.nih.gov/geo/download/?acc=GSE48191&amp;format=file    I get only index.html?acc=GSE48191 which is some kind of binary format.  How can I download the files from this HTTP site?
118636
I cant find the MD5 hash for ubuntu-14.04.1-desktop-amd64.iso on  website.  Am I looking in the right place?
7535
I am trying to update the ISO image of Ubuntu using Jigdo . Can any one explain the exact way to do this ?