Securely Download lubuntu from Non-Ubuntu System

Question

The recommended way to find out which public key you need to verify the Ubuntu hashes is to attempt to check a signature of the hash file (both of which were downloaded in the clear). This produces an error indicating which key was used to sign the hashes:

gpg: Signature made Thu Apr  5 22:19:36 2018 EDT using DSA key ID FBB75451
gpg: Can't check signature: No public key
gpg: Signature made Thu Apr  5 22:19:36 2018 EDT using RSA key ID EFE21092
gpg: Can't check signature: No public key

My question is: if everything is downloaded in cleartext and an attacker can modify the ISO and the hash file, couldn't they also sign the hash file with their own public key and then publish that key to the key server? I would download their signature which would error out their key which I would naively download from the key server. Don't I need to at least have secure access to the key ID for their public key?

How can I securely download lubuntu if I don't already have the Ubuntu signing keys on my machine?

Answer 1

This is where the concept of TOFU (Trust On First Use) comes in. You will need to download the public key from a trusted source at least the first time, which makes it a little tricky when you can only download it from the same server that is also providing the ISO and signature. In order to make sure you are using the correct public key, you need to check that its fingerprint matches the fingerprint that the developers are using. I would suggest looking through Twitter or various mailing lists to try to find the signature so you can confirm that it matches the public key you have.

Looking it up online, I see that DistroWatch provides a copy of the keys. You could also send an email to request the fingerprint, or go on their IRC channel and ask.