Lesson 2.7: Verifying downloads
How publishers let you check that a file is exactly what they released: published checksums, sha256sum -c, and why a checksum from the same place as the file isn't enough, which is what digital signatures add. In the lab you downloaded a monitoring agent for two server types, one from the vendor and one from a mirror. You check both against the vendor's SHA256SUMS, catch the tampered one, look at what was added, and remove it before anyone installs it.
15 min
You will learn to
- Explain what a published checksum proves
- Verify files with sha256sum -c
- Recognise a failed check and act on it
- Explain why checksums need a trusted source
- Explain how signatures and HTTPS complete the picture
Key terms
- Checksum
- A value computed from a file to check it later. For security it must be a cryptographic hash such as SHA-256.
- Mirror
- A server that hosts copies of someone else's files to spread the download load.
- Digital signature
- A value made with a private key that anyone can check with the matching public key; it proves who published a file and that it wasn't changed.
- Supply-chain attack
- Attacking a target through the software or services it trusts, for example by tampering with an update or a download.
← The same-origin policy and CORS · All lessons · The attack surface: every door into a system →