Bad GPG signature of http://releases.ubuntu.com/bionic/SHA256SUMS

[Marius Gedminas]

http://releases.ubuntu.com/bionic/ currently has a SHA256SUMS.gpg with a timestamp older than SHA256SUMS itself (2020-08-13 15:02 vs 2020-08-13 15:39), and the signature itself doesn't match:

$ wget http://releases.ubuntu.com/bionic/SHA256SUMS{,.gpg}
$ gpgv --keyring=/usr/share/keyrings/ubuntu-archive-removed-keys.gpg --keyring=/usr/share/keyrings/ubuntu-archive-keyring.gpg SHA256SUMS.gpg SHA256SUMS
gpgv: Signature made Thu Aug 13 18:02:20 2020 EEST
gpgv: using RSA key 843938DF228D22F7B3742BC0D94AA3F0EFE21092
gpgv: BAD signature from "Ubuntu CD Image Automatic Signing Key (2012) <email address hidden>"

Should I be worried about the integrity of the ubuntu-18.04.5-live-server-amd64.iso image I've just downloaded?

[Iain Lane (laney)]

Thanks. I don't know how that came to be wrong (AFAICT it was asserting the contents of a previous version of SHA256SUMS), but I re-generated it now and it's good.