Write install media safely and verify the image

short · 25 min

Task

Verify an installation image's signature -- not just its checksum -- and write it to a USB stick without destroying the machine you are working on. The dd target mistake is unforgiving, so the whole point is the habit that prevents it.

Steps

  1. Download a distribution ISO along with its checksum file, the checksum's GPG signature, and the project's signing key.
  2. Verify the checksum: sha256sum -c CHECKSUM. State what this does and does not prove.
  3. Verify the SIGNATURE on the checksum file: gpg --verify CHECKSUM.gpg CHECKSUM after importing the key. This is what establishes origin, and it is the step people skip.
  4. Identify the USB device with lsblk immediately before writing, and confirm its size matches the stick -- not a system disk. Write the device name down and read it twice.
  5. Write the image: sudo dd if=distro.iso of=/dev/sdX bs=4M status=progress oflag=sync, with sdX being the device you just confirmed. Then sync.
  6. Verify the write by comparing a hash of the first N bytes of the device against the ISO, or by booting the stick.
  7. Describe the safer alternatives -- Fedora Media Writer, Ventoy -- and why they exist: a confirmation step between you and the wrong device.

Verify

sha256sum -c CHECKSUM 2>&1 | grep -qi 'OK' && echo "checksum matches"
gpg --verify CHECKSUM.gpg CHECKSUM 2>&1 | grep -qi 'Good signature' && echo "origin verified"
lsblk -o NAME,SIZE,TYPE,MOUNTPOINT   # confirm the target is the stick, not a disk

Both the checksum and the signature must verify before you write anything. The checksum alone proves only that the download was not corrupted; anyone who could swap the ISO on a mirror could swap the checksum beside it. The signature is the difference.

Notes

dd writing to /dev/sda instead of /dev/sdb destroys the machine you are on, with no prompt and no undo. The single habit that prevents it is lsblk immediately before, every time, with the size as a sanity check. There is no recovery step in this lab because there is no recovery.