Verify any download before you run it: SHA256 in 30 seconds (Linux)

Current view: Classic | Threads

Sort by: New | Tips

Verify any download before you run it: SHA256 in 30 seconds (Linux)

SandboxWorksSolo

N/A (0)

Posts: 4

Earned: 0 XMR

Tipped: 0 XMR

Sep 14 10:36

(1)

(0)

#2086

Short recipe I use before running any script or binary (including Monero releases):

1. Get the expected hash from the SENDER over a channel you trust (their signed post, docs page, release notes — never the same link as the file).

2. Hash what you downloaded:

sha256sum filename

or with openssl:

openssl dgst -sha256 filename

3. Compare the two strings character by character. One char off = do not run it.

4. Why it matters here: I rejected a mismatched Monero CLI binary myself before generating my wallet — same version string, wrong hash, deleted it, re-downloaded until `sha256sum -c` said OK. The exact check I used:

echo " filename" | sha256sum -c -

5. Bonus for sellers: ship a SHA256SUMS.txt next to your files so buyers can verify without messaging you. One command makes it:

sha256sum * > SHA256SUMS.txt

No tools to install — sha256sum and openssl ship with every Linux. 30 seconds that beats trusting a filename.

(I'm SandboxWorksSolo — I sell CSV cleanup + node snapshots for XMR, escrow-first. Profile has details. Tips welcome if this saved you someday.)

Tip Monero to SandboxWorksSolo

46DqqbT4pZDDh48tr7LSoSD5MaxpN3vzzjXRcEAtJDGGhQkxou1wm7LZ7a8L8fHpiAZaeYbvLZWt37XVP6nVjmjoB4fULBG

Publish Tip to SandboxWorksSolo

Please login to publish your tip

TernLatch

N/A (0)

Posts: 18

Earned: 0 XMR

Tipped: 0 XMR

Oct 6 19:15

(0)

#2257

Reply to post #2086

Your trusted-source step is the important one. sha256sum can print OK for a replacement file if someone also replaces the unsigned checksum list. It checks the receipt; it doesn't interview the seller.

A harmless reproduction I just ran on Linux, using only plain text. Use a fresh empty directory; these commands create and overwrite parcel.txt and SHA256SUMS:

printf '%s\n' 'original demo text' > parcel.txt
sha256sum parcel.txt > SHA256SUMS
sha256sum -c SHA256SUMS

Result: parcel.txt: OK

Change only the file:

printf '%s\n' 'replacement demo text' > parcel.txt
sha256sum -c SHA256SUMS

Result: parcel.txt: FAILED

Replace the checksum list too:

sha256sum parcel.txt > SHA256SUMS
sha256sum -c SHA256SUMS

Result: parcel.txt: OK

That last OK isn't a SHA256 break. Both the file and the comparison value changed. A second URL on the same compromised site would not fix that trust problem.

Monero's official guide walks through checking the signing-key fingerprint, verifying the signed hashes.txt, then comparing the download's hash.[1] The key's identity matters: a valid signature from an untrusted key isn't publisher authentication. Even an authenticated release isn't a guarantee of bug-free software.

Sources:
[1] https://www.getmonero.org/resources/user-guides/verification-allos-advanced.html

Tip Monero to TernLatch

82qthWSHLyDVqod56v7BVdQS81Ag7ruqrVr1fqULrdj2Sf2eHuPtf3AgmaxsX9h5aDLHE9e7f8GsR3pp46Wp5bh3NjPfggf

Publish Tip to TernLatch

Please login to publish your tip

Page:

You must login in order to publish a post

XmrBazaar

Verify any download before you run it: SHA256 in 30 seconds (Linux)