Verify Downloaded Files with SHA-256 Checksums

Practice using SHA-256 checksums to verify file integrity, detect corrupted or modified files, and confirm that downloaded data matches the original.

#sha256 #checksums #linux-101

A file stored in a remote storage can be damaged, truncated, or replaced. A cryptographic digest (e.g., SHA-256) turns the content of a file into a short fingerprint string. The same file always gives the same digest, and a change of a single byte gives a completely different one. File publishers often put digests next to their artifacts, so that whoever downloads the file can always verify its integrity.

In this challenge, you will work on workstation-01 with the sha256sum tool and an internal file server at http://files.corp.internal.

Task 1: Compute a Digest

A vendor sent a binary that is now stored at ~/downloads/vendor-tool.bin. Compute its SHA-256 digest so you can confirm it with the vendor.

Hint 1

The sha256sum <file> command prints the digest followed by the file name. There is a family of such tools, one per algorithm: md5sum, sha1sum, sha256sum, sha512sum.

Task 2: Pick the Undamaged Download

The 1.4.2 release of the report-builder service is available on two mirrors of the internal file server:

http://files.corp.internal/mirror-a/app-1.4.2.tar.gz
http://files.corp.internal/mirror-b/app-1.4.2.tar.gz.

One of the mirrors serves a damaged copy. The release team published the expected checksum at http://files.corp.internal/releases/app-1.4.2.tar.gz.sha256.

Download the release, make sure the copy matches the published checksum, and store the good copy at ~/release/app-1.4.2.tar.gz.

Hint 2

The curl -o <file> <url> command downloads a file. You can download both copies under different names, compute the digest of each, and compare with the published one.

Task 3: Check a Directory Against a Checksum List

The ~/incoming directory holds the files of a release that was copied from a build server, together with a SHA256SUMS file listing the expected digest of every file. One of the files was damaged during the copy. Can you identify which one?

Hint 3

The sha256sum -c SHA256SUMS command reads every line of the list, computes the digest of the named file, and prints OK or FAILED per file. Run it inside the directory, or the file names in the list will not resolve.

Task 4: Fetch a File by Its Digest

The file ~/configs/settings.json was published together with its digest, which is stored next to it in ~/configs/settings.json.sha256. A colleague opened the file in an editor that reformatted it on save, so the file no longer matches its digest, and a deployment check now refuses it.

The file server keeps every published file under its digest at http://files.corp.internal/blobs/sha256:<digest>. Restore ~/configs/settings.json to the published version so that it matches its digest again.

Hint 4

Confirm the problem first: run the check against settings.json.sha256 inside ~/configs and see it fail. Then take the digest from that file, build the blob URL from it, and download the blob over the existing file. Run the check again to confirm the fix.

Start challenge