Write install media safely and verify the image

short · 25 min

Task

Verify an installation image's signature -- not just its checksum -- and write it to a USB stick without destroying the machine you are working on. The dd target mistake is unforgiving, so the whole point is the habit that prevents it.

Steps

  1. Download a distribution ISO along with its checksum file, the checksum's GPG signature, and the project's signing key. Then get the key's FINGERPRINT from somewhere other than the download mirror -- the project's own website over HTTPS, its documentation, or a system already running that distribution. Write it down. This is the step that makes step 3 mean anything: whoever can swap an ISO and its checksum on a mirror can swap the key sitting beside them too.
  2. Verify the checksum: sha256sum -c CHECKSUM. State what this does and does not prove.
  3. Verify the SIGNATURE on the checksum file: gpg --verify CHECKSUM.gpg CHECKSUM after importing the key. Then compare the fingerprint gpg reports with the one you wrote down in step 1. "Good signature" alone means only that the checksum was signed by the key you imported -- which an attacker can arrange with a key of their own. The fingerprint match is what establishes origin, and it is the step people skip. (Some projects, Fedora among them, sign the checksum file inline instead of beside it; then it is gpg --verify CHECKSUM.)
  4. Identify the USB device with lsblk immediately before writing, and confirm its size matches the stick -- not a system disk. Write the device name down and read it twice.
  5. Write the image: sudo dd if=distro.iso of=/dev/sdX bs=4M status=progress oflag=sync, with sdX being the device you just confirmed. Then sync.
  6. Verify the write by comparing a hash of the first N bytes of the device against the ISO, or by booting the stick.
  7. Describe the safer alternatives -- Fedora Media Writer, Ventoy -- and why they exist: a confirmation step between you and the wrong device.

Verify

sha256sum -c CHECKSUM 2>&1 | grep -qi 'OK' && echo "checksum matches"
FPR=<the fingerprint from step 1, without spaces>
gpg --verify --status-fd 1 CHECKSUM.gpg CHECKSUM 2>/dev/null | grep -q "VALIDSIG.*$FPR" && echo "origin verified"
lsblk -o NAME,SIZE,TYPE,MOUNTPOINT   # confirm the target is the stick, not a disk

Both the checksum and the signature must verify before you write anything. The checksum alone proves only that the download was not corrupted; anyone who could swap the ISO on a mirror could swap the checksum beside it. The signature is the difference -- but only through the fingerprint. A check that greps for "Good signature" passes for a key the attacker made, which is why this one matches the signing key's fingerprint against the one you obtained separately.

Notes

dd writing to /dev/sda instead of /dev/sdb destroys the machine you are on, with no prompt and no undo. The single habit that prevents it is lsblk immediately before, every time, with the size as a sanity check. There is no recovery step in this lab because there is no recovery.

This is an independent study companion for CompTIA Linux+ and is not produced by or endorsed by CompTIA.