31

I keep on finding myself wanting to download and check the integrity of the download immediately in a script, but I haven't been able to find the right incantation of sha256sum.

MY_SHA256=e147f0392686c40cfd7d5e6f332c6ee74c4eab4d24e2694b3b0a0c037bf51dc5
sha256sum some_binary | sha256sum --check ${MY_SHA256}

How can I take the sha256sum of a new file and compare it with a known hash immediately?

Improve this question
14

I have downloaded an archive file and an accompanying checksum file. Here is how I verify that the hash of the downloaded archive matches the hash from the downloaded checksum file:

echo "$(cat archive.tar.gz.sha256) archive.tar.gz" | sha256sum --check --status

The --status flag prevents all stdout output (more effective than --quiet). I then need to rely on the return code to determine if they matched, which is what I want anyway since I'm going to be using this in a script.

Improve this answer
3
  • 1
    Well, in my case, since file sha512 already contains the filename, so what i should do is echo "$(cat filename.sha512)" | sha512sum --check --status and immediately check return value using $? – fa wildchild May 18 '20 at 15:03
  • 1
    It’s almost never useful to do echo "$(some-command)".  Just run the command; for example, cat filename.sha512 | sha512sum --check --status.  But that’s a UUOC; do sha512sum --check --status < filename.sha512 instead, or even sha512sum --check --status filename.sha512 (without the <).  Which, in fact, is fairly straightforward and obvious from the documentation.  … (Cont’d) – Scott Feb 18 at 19:42
  • P.S. That’s fine if you’re writing a script, although you shouldn’t need to reference $? explicitly. But, if you’re doing this manually, and you’re doing echo $? and looking at the output, you might as well leave off the --status and let sha512sum tell you the result. – Scott Feb 18 at 19:42
20

You can see that sha256sum --check takes the output of a previous (regular) sha256sum run: it takes hashes and filenames via stdin, and compares them against actual files.

So the obvious thing to do is to manually give it the output in the format it wants:

$ echo "da39a3ee5e6b4b0d3255bfef95601890afd80709  motd" | sha1sum --check
motd: OK
Improve this answer
1
  • 1
    It seems to be taking the path to the file given in the std input and performing another sha256sum on that. – tarabyte Apr 10 '18 at 20:47
17

Example:

 echo "67574ee0039eaf4043a237e7c4b0eb432ca07ebf9c7b2dd0667e83bc3900b2cf kali-linux-2019.2-amd64.iso" | sha256sum -c

In case you have the sha256sum file, you can directly use it:

sha256sum -c "kali-linux-2019.2-amd64.iso.txt.sha256sum"

Explanation:

In the above example, you have

echo "<known SHA 256 sum of the file> <name of the file>" | sha256sum -c

sha256sum -c option can either read the SHA256 sum from a sha256sum file or from STDIN. In case you don't have the sha256sum file, then using the echo command you can provide the same details contained in a sha256sum file.

In case you have the sha256sum file, you can directly use it:

sha256sum -c "<sha256sum file name>"

Note:

Alternatively, you can use shasum -a 256 instead of sha256sum where -a specifies the algorithm to be used.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.