How to verify checksum file of centos 8?

Question

How to verify that the CHECKSUM file for the CentOS 8 ISO is real?

Download check sum and key:

$ wget https://www.centos.org/keys/RPM-GPG-KEY-CentOS-Official
$ wget http://www.gtlib.gatech.edu/pub/centos/8.0.1905/isos/x86_64/CHECKSUM
$ wget http://www.gtlib.gatech.edu/pub/centos/8.0.1905/isos/x86_64/CHECKSUM.asc

Verify Key:

$ gpg RPM-GPG-KEY-CentOS-Official 

gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa4096 2019-05-03 [SC]
      99DB70FAE1D7CE227FB6488205B555B38483C65D
uid           CentOS (CentOS Official Signing Key) <[email protected]>

Assert that the fingerprint matches https://www.centos.org/keys/

import key:

$ gpg --import RPM-GPG-KEY-CentOS-Official
gpg: key 05B555B38483C65D: public key "CentOS (CentOS Official Signing Key) <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1

Cannot verify the CHECKSUM file:

$ gpg --verify CHECKSUM.asc

gpg: Signature made Mon 23 Sep 2019 07:24:37 AM EDT
gpg:                using RSA key 05B555B38483C65D
gpg: Good signature from "CentOS (CentOS Official Signing Key) <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 99DB 70FA E1D7 CE22 7FB6  4882 05B5 55B3 8483 C65D
gpg: WARNING: not a detached signature; file 'CHECKSUM' was NOT verified!

It says:

 gpg: WARNING: not a detached signature; file 'CHECKSUM' was NOT verified!

Answer 1

You don't need both CHECKSUM and CHECKSUM.asc. The latter is GPG-signed version of CHECKSUM. GPG is confused because it assumes that if you have somefilename and somefilename.asc, that the .asc file is a detached signature.

If you delete the file CHECKSUM, then you can gpg --verify CHECKSUM.asc and get:

gpg: Signature made Mon 23 Sep 2019 07:24:37 AM EDT
gpg:                using RSA key 0x05B555B38483C65D
gpg: Good signature from "CentOS (CentOS Official Signing Key) <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 99DB 70FA E1D7 CE22 7FB6  4882 05B5 55B3 8483 C65D

Answer 2

There is no problem here in fedora 34 workstation (host).

[chris@f34 verify-centos]$ ll
total 741388
-rw-r--r--. 1 chris chris 759169024 Jun  5 11:46 CentOS-Stream-8-x86_64-20210603-boot.iso
-rw-r--r--. 1 chris chris       355 Jun  5 15:15 CHECKSUM
-rw-r--r--. 1 chris chris       811 Jun  5 15:17 CHECKSUM.asc
-rw-r--r--. 1 chris chris      1683 Jun  5 17:30 RPM-GPG-KEY-CentOS-Official
[chris@f34 verify-centos]$

Remember that the pgp-signature files like CHECKSUM.asc is generate by another file. I suppose the procedure of the Centos team was approximately the following.

sha256sum CentOS-Stream-8-x86_64-20210603-boot.img > CHECKSUM

gpg --sign --armor CHECKSUM

The above commands generates both files CHECKSUM and CHECKSUM.asc.

This page has a useful guide, verify fedora images

---

Steps to verify:

First you need to import the keys, click in the download link, then CTRL + save.

Then import.

gpg --import RPM-GPG-KEY-CentOS-Official

Then verify that the CHECKSUM file is valid, here you need the following both files

• CHECKSUM
• CHECKSUM.asc

Verify with the following commands

gpg --verify CHECKSUM.asc

[chris@f34 verify-centos]$ gpg --verify CHECKSUM.asc 
gpg: assuming signed data in 'CHECKSUM'
gpg: Signature made Thu 03 Jun 2021 01:58:15 AM -05
gpg:                using RSA key 05B555B38483C65D
gpg: Good signature from "CentOS (CentOS Official Signing Key) <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 99DB 70FA E1D7 CE22 7FB6  4882 05B5 55B3 8483 C65D
[chris@f34 verify-centos]$

The importan line is This

gpg: Good signature from "CentOS (CentOS Official Signing Key) <[email protected]>" [unknown]

All is ok.

Now and lastly

Verify the hash number of the Centos image file downloaded match with the hash number inside the CHECKSUM file. Remember that the CHECKSUM file can have inside multiple hash numbers of the different versions, in this case there are 2 versions

You can do it in multiples ways.

First way:

Run the following command.

sha256sum CentOS-Stream-8-x86_64-20210603-boot.iso

[chris@f34 verify-centos]$ sha256sum CentOS-Stream-8-x86_64-20210603-boot.iso 
6d957521b4488fc44bb80bdcb618bc1cf9891a997fdbd94e22424c14a356cf09  CentOS-Stream-8-x86_64-20210603-boot.iso
[chris@f34 verify-centos]$ 

And compare this hash number 6d957521b4488fc44bb80bdcb618bc1cf9891a997fdbd94e22424c14a356cf09 with the one inside the CHECKSUM file in the corresponding line of the image, the hash numbers must match each other.

As you can see, the hash numbers matches.

Second way:

Run the following command. Select the hash number inside the CHECKSUM file copy and paste there after grep command.

sha256sum CentOS-Stream-8-x86_64-20210603-boot.iso | grep paste-here-the-hash-number

If the color is red all is ok, It means both matches.

Third way

The easiest way, both files are neccesary.

• CentOS-Stream-8-x86_64-20210603-boot.iso
• CHECKSUM

Run the follwing command

sha256sum -c CHECKSUM

[chris@f34 verify-centos]$ sha256sum -c CHECKSUM
CentOS-Stream-8-x86_64-20210603-boot.iso: OK
sha256sum: CentOS-Stream-8-x86_64-20210603-dvd1.iso: No such file or directory
CentOS-Stream-8-x86_64-20210603-dvd1.iso: FAILED open or read
sha256sum: WARNING: 1 listed file could not be read
[chris@f34 verify-centos]$ 

As we can see in there say ok

CentOS-Stream-8-x86_64-20210603-boot.iso: OK

End.