sha256sum: Verify a Download Checksum in CI
sha256sum prints a SHA-256 hash and file name, and with -c verifies a file against a published checksum.
Verifying a downloaded tool or release against its published SHA-256 is the single most important integrity check in a pipeline. sha256sum -c does it in one line.
What it does
sha256sum outputs HASH FILENAME (two spaces). With -c FILE it re-hashes each listed file and prints OK/FAILED, exiting non-zero on any mismatch. SHA-256 is cryptographically strong, so a match is meaningful evidence the bytes are the published ones. Part of coreutils.
Common usage
# verify a download against an inline expected hash
echo "EXPECTED_HASH tool.tar.gz" | sha256sum -c -
# verify against a published SHA256SUMS file
sha256sum -c --ignore-missing SHA256SUMS
# generate checksums for release artifacts
sha256sum dist/* > dist/SHA256SUMS
# compare a single value directly
test "$(sha256sum tool | cut -d' ' -f1)" = "$EXPECTED"Options
| Flag | What it does |
|---|---|
| -c, --check | Verify files against a checksum list |
| --ignore-missing | Skip listed files that are not present |
| --status | No output; exit code only (scripting) |
| --quiet | Only print FAILED lines |
| -b | Read in binary mode (marks name with *) |
In CI
Pin the expected hash in the workflow and verify before you execute a downloaded binary: curl -fsSL "$URL" -o tool && echo "$SHA tool" | sha256sum -c - || exit 1. This stops a compromised mirror or a truncated download from running. Use --status when you want only the exit code to gate a step.
Common errors in CI
"tool.tar.gz: FAILED" with "sha256sum: WARNING: 1 computed checksum did NOT match" means the file is not the expected bytes (wrong version, corrupted, or a saved HTML error page); the command exits 1. "sha256sum: SHA256SUMS: no properly formatted checksum lines found" means the list lost its exact hash name two-space format (a common cause is CRLF line endings or a single space). "sha256sum: WARNING: N listed files could not be read" means names in the list are missing; add --ignore-missing if intended.