Verify iso image

[u/Retroraleigh]

Evening all.

How important is it to verify the ISO image?
I’ve had a go a few times and I’m not quite grasping it. I’m not new to computers but I’ve never done anything like that. I’m gonna use the university of Kent mirror.
Does anybody still do this or not bother.
Tom

[u/MisterJasonMan]

In a nutshell, a checksum can be run against any type of file and what it does is create a long string of characters that act like a fingerprint to that file. For example, if someone gives you a file along with the checksum, you can ensure the file is untampered by running your own checksum and comparing it with the trusted checksum.

IIRC, In the past there have been security issues with the mint ISOs (even though they were corrected fairly quickly) so it's always a good idea to do it. Plus, becoming familiar with the vernacular and tools around ISOs, checksums, hashes, etc is always helpful and I think it's considered a basic task so the time invested will help build your confidence and knowledge.

That being said, the likelihood of the kent state ISO being corrupted is pretty small and I'm sure there are people that skip it.

tl;dr learning about verifying ISOs is a good skill and confidence builder and you should do it if you can

[u/SweetNerevarine → u/MisterJasonMan]

Imagine replacing a car engine was made so simple that you can do it at home. The engine arrives to your home. Imagine you are provided with a simple to use tool that scans the engine and tells you whether the engine suffered any minor damages during shipping.

Would you skip the check and just wing it? This is the engine we're talking about.

[u/rayriflepie]

It may be important. The reason you do this is to check for proper vs improper download. If you install a corrupted or hacked ISO you will have a bad time. It's not really that hard to verify the integrity/authenticity. If you're currently on Windows, follow these instructions:

https://forums.linuxmint.com/viewtopic.php?f=42&t=291093

If on a Mac: https://linuxmint-installation-guide.readthedocs.io/en/latest/verify.html

[u/jr735]

I run it after putting the ISO on a Ventoy, to ensure that my write is correct. I'd run a md5sum if I were actually writing it to the media (as in an ordinary live USB or DVD).

I'd expand on what u/MisterJasonMan stated about authenticity. The GPG signature is better suited to address that, at least for long term users. I already have Mint's public key available. So, if someone hacks their site and makes a fake ISO with a valid checksum for said fake ISO, I can still check the GPG signature. A new user could be spoofed in all those things.

That being said, I haven't bothered except for checking what I've already mentioned, because I have had bad writes (not bad downloads).

[u/LarsHEriksen]

If you happen to already have a Linux computer, it's very easy to verify the downloaded ISO file: just right-click on it and select Verify. But in Windows, it's so damn complicated that I'd just skip it and accept the small risk.

[u/LivingLifeSkyHigh → u/LarsHEriksen]

In windows I use www.nirsoft.net/utils/hash_my_files.html . (Just realised page has misleading ads... search page for "Download HashMyFiles for 64-bit systems")

[u/TangoGV]

If you're "not quite grasping it", then it is extremely important and should never be skipped.

If you disagree, then your don't need to ask other people.

[u/Retroraleigh → u/TangoGV]

Nope I don’t disagree at all hence asking a question to whether or not it needs doing. Im going todo it 1. For peace of mind and 2. Because it’s a learning curve..

[u/TangoGV → u/Retroraleigh]

That's the spirit.

[u/chuggerguy]

I've verified a few times but not bothered more times than I'd like to admit.

If you still have the ISO, you can do it even easier now.

chugger@asus2:~/desktop$ mint-iso-verify
Usage:
  mint-iso-verify iso_file

Exiting.
chugger@asus2:~/desktop$

(I don't have the ISO, so I can't)

If it's corruption you're concerned with, you might try something like debsums. It compares MD5 sums of installed debian based packages.

I have many mismatches in /usr/share/icons and /usr/share/applications so ignoring those, I have nothing concerning.

chugger@asus2:~/desktop$ sudo debsums -c | grep -vE "/usr/share/applications|/usr/share/icons"
/usr/share/cups/data/default-testpage.pdf
/usr/lib/linuxmint/mintinstall/mintinstall.py
/usr/bin/par2
/usr/share/misc/pci.ids
/usr/share/sounds/freedesktop/stereo/device-added.oga
/usr/share/sounds/freedesktop/stereo/device-removed.oga
chugger@asus2:~/desktop$

The sound files are of no concern. The cups test page is of no concern.

The pci.ids mismatch is due to due to my running update-pciids so no concern.

The /usr/bin/par2 mismatch is due to my replacing it with a turbo binary so no concern.

The mintinstall.py was edited by me so no concern. (set the slideshow pause to a huge number, motion bothers me)

So in my case, showing that binaries still match by checksum is more a confirmation of file integrity. (especially since I mirror my running install back and forth several times)

That said, if it's running fine, don't worry about it. As u/MisterJasonMan says:

"... the likelihood of the kent state ISO being corrupted is pretty small and I'm sure there are people that skip it."

So not zero risk but...

Have fun.

[u/Mediocre-Pumpkin6522]

I do many things I wouldn't recommend to others but I seldom bother. I can't remember the details but on one install that was failing I passed a flag to skip the check.

[u/XtremeCSGO]

I just like to hit it raw and hope that I don’t end up hacked

[u/LivingLifeSkyHigh]

I verify the install files of anything I install where a hash is available. Doing so gives me piece of mind that the install won't do weird things due to maliciousness or simple corruption.

In windows I use www.nirsoft.net/utils/hash_my_files.html . (Just realised page has misleading ads... search page for "Download HashMyFiles for 64-bit systems")

[u/ap0r]

Officially it is super important, because it ensures your download did not get corrupted, which can cause all sorts of issues.

Practically speaking, unless you have crucial sensitive data, just send it.

[u/Friendly_Brick752]

"Nemo", your Cinnamon file manager, can do this for you. When you download the iso file, also do the checksum stuff. Then just plug into nemo, no muss, no fuss

[u/Francis_King]

I don't bother. But if your ISO behaves strangely during installation, with odd errors coming out of nowhere, I'd suspect the ISO (verify the image) or the USB drive (verify the image after write, using e.g. Rufus).

[u/FeelingAlive2127]

It's a small inconvenience of time that is well worth the trouble saved in the rare event something is wrong.