Canonical’s verification tutorial separates two checks: authenticate the checksum list using GnuPG, then compare the downloaded ISO with that list. A hash copied from an untrusted page is not enough; an attacker could replace both the image and the displayed hash.

Get SHA256SUMS and SHA256SUMS.gpg for the exact release containing your ISO. Follow Canonical’s current signing-key instructions and check the full fingerprint through a trusted Ubuntu source. Do not trust a key solely because its displayed user name looks official; old example key IDs in a tutorial are not a reason to skip this check.

With GnuPG available, run gpg --verify SHA256SUMS.gpg SHA256SUMS in the download directory. The GnuPG manual recommends explicitly naming the signed data file for a detached signature. A good signature links the file to that key; you must still establish that it is the intended Ubuntu key. Stop on a bad signature or an unresolved key identity.

Only then run sha256sum -c SHA256SUMS and read the full output. A release list can include images you did not download, so verify that your exact ISO reports OK rather than accepting a different filename’s result. If the target fails, do not install it: obtain a fresh copy from an official source and repeat both checks.