Kubuntu 20.04 LTS Review Supplement: Pre-Installation

Introduction

When a potential user is considering downloading and installing a distribution, they obviously go to the distribution's website to download the installation image. But user's need more than just an easy to find download link. Resources for verifying the integrity of the download, such as checksums, and the authenticity of the image, such as GPG signatures and the associated public key, are necessary. Additionally documentation for the verification, installation, and known issues make for a less frustrating experience for uses that are not familiar with these aspects of the initial experience with a distribution.

The Kubuntu website provides a very prominent Download link but the other features necessary for a good pre-installation except, a link to release-notes, are sadly missing.

Download

`

Verification

There is a prominent link to "Alternative downloads, mirrors, torrents, and check-sums" directly below the 64-bit Download button. Following this link one finds a list of checksums at the bottom of the resulting page. However checksums only provide the download integrity and not authenticity. Distributions either sign a file that contain the checksum and provide the public key for the signature, or they provide both a signed ISO with a signature and public key and a separate checksum, the former being more prevalent these days.

Ubuntu provides these mechanisms to Kubuntu as it is an official Ubuntu flavor, but there is no way to know this based on the Kubuntu website, which, as mentioned above only provides a SHA256 checksum. There is a convenient link to "HowToSHA256SUM" that opens an Ubuntu Wiki page that does provide instructions to perform the verification using the SHA256SUM, but again this is not adequate without a signature.

So I had to look for the resources that would also allow me to verify the authenticity of the ISO. I began by going to the download page for the default Ubuntu flavor which led me to an Ubuntu page for the Kubuntu release, shown below, that has all the installation images, as well as checksums and the signatures for the checksums.

The I had to find documentation that provided instructions to perform the verification (see the next section), after which I was able to perform the verification, as shown in the terminal window of the previous screenshot.

`

Documentation

Documentation related to pre-installation and installation tasks were inadequate, in my opinion. There are no links to relevant documentation on any of the download related pages. There are links to documentation in the form of complete versions of from the main pages Help and Support category, but the latest versions of Kubuntu for which this documentation is available is dated July 29, 2018 more than two months before the 18.10 release, although the file name indicates it is for the 19.04 release. This documentation, while not current and not complete, is a good beginning for an excellent document that introduces users to using Kubuntu and the Plasma Desktop Environment.

Of resources essential to pre-installation activities, one is the public key used to verify authenticity using GPG and the associated documentation. As mentioned above I found the signature file itself on an Ubuntu site. I again had to use an Ubuntu page for the relevant documentation which provided instructions on how to download the keys and perform the verification.

`

Conclusion

The Kubuntu website provides a prominent download link to installation media, the most important thing for users who want to install the distribution. Unfortunately, it is lacking in other aspects of pre-installation, most important of these is easy to find and current resources for verifying the authenticity of the installation medium, instead of just an MD5 checksum, which not only does not verify authenticity of the medium but is currently regarded as not even an adequate means of verifying the download integrity.