I downloaded the iso from https://getfedora.org/en/workstation/download/

Next, I attempted to follow the instructions at https://getfedora.org/en/verify

I downloaded the checksum file from the following url:


I then validated it from the command line:

$ gpg --verify-files *-CHECKSUM
gpg: Signature made Fri 22 May 2015 12:47:01 PM PDT using RSA key ID 8E1431D5
gpg: Good signature from "Fedora (22) <fedora@fedoraproject.org>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: C527 EA07 A934 9B58 9C35  E1BF 11AD C094 8E14 31D5

Since the RSA key ID matched, I figured the checksum file was good. Finally, I attempted to match the iso image's checksum with the checksum file:

$ sha256sum -c *-CHECKSUM
sha256sum: Fedora-Workstation-netinst-x86_64-22.iso: No such file or directory
Fedora-Workstation-netinst-x86_64-22.iso: FAILED open or read
Fedora-Live-Workstation-x86_64-22-3.iso: FAILED
sha256sum: WARNING: 20 lines are improperly formatted
sha256sum: WARNING: 1 listed file could not be read
sha256sum: WARNING: 1 computed checksum did NOT match

The first two sha256sum message lines above are expected, since the ...netinst-x86...iso file doesn't exist in my directory. Investigating the ...Live... checksum verification failure, I got:

$ sha256sum Fedora-Live-Workstation-x86_64-22-3.iso
  1. Has anyone else gotten the same results that I did?

  2. With respect to the checksum file downloaded from the following url


what is the significance of the "sha256sum: WARNING: 20 lines are improperly formatted" message?


I think your image is simply actually failing the checksum, either because of a bad mirror, corruption in transit, or local problems. Re-download and try again?

I get

$ sha256sum Fedora-Live-Workstation-x86_64-22-3.iso
615abfc89709a46a078dd1d39638019aa66f62b0ff8325334f1af100551bb6cf  Fedora-Live-Workstation-x86_64-22-3.iso

exactly as in the official, signed file.

(The 20 invalid lines are the GPG signature; the sha256sum command doesn't know to skip that, and our secure signing system doesn't do detached signatures.)

  • 1
    Re-executed the download, and re-checked the checksum; it is now good. This confirms mattdm's hypothesis; my previous download was (for some unknown reason) bad. – user2661923 Jun 10 '15 at 19:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.