How to verify a checksum using one command line?

Question

Suppose I type and run the following command:

sha256sum ubuntu-18.04.1-desktop-amd64.iso

After a delay, this outputs the following:

5748706937539418ee5707bd538c4f5eabae485d17aa49fb13ce2c9b70532433  ubuntu-18.04.1-desktop-amd64.iso

Then, I realize that I should have typed the following command to more rapidly assess whether the SHA‐256 hash matches:

sha256sum ubuntu-18.04.1-desktop-amd64.iso | grep 5748706937539418ee5707bd538c4f5eabae485d17aa49fb13ce2c9b70532433

Is there a way to act on the first output without using the sha256sum command to verify the checksum a second time (i.e., to avoid the delay that would be caused by doing so)? Specifically:

1. I'd like to know how to do this using a command that does not require copy and pasting of the first output's checksum (if it's possible).
2. I'd like to know the simplest way to do this using a command that does require copy and pasting of the first output's checksum. (Simply attempting to use grep on a double‐quoted pasted checksum (i.e., as a string) doesn't work.)

Answer 1

You can create a simple function in your .bashrc or .zshrc configurations and run it in the following way:

sha256 <expected-sha-256-sum> <name-of-the-file>

It will compare the expected sha256 sum with the actual one in a single command.

The function is:

sha256() {
    printf '%s %s\n' "$1" "$2" | sha256sum --check
}

Please find more details here.

Answer 2

Q1: I'd like to know how to do this using a command that does not require copy and pasting of the first output's checksum (if it's possible).

Bash provides no mechanism to recall any output from the previously run command. You have to capture it explicitly if you intend to act on it in any subsequent commands.

Q2: I'd like to know the simplest way to do this using a command that does require copy and pasting of the first output's checksum. (Simply attempting to use grep on a double‐quoted pasted checksum (i.e., as a string) doesn't work.)

So your only option here is to copy/paste the output from the previous command. With respect to why this wasn't working for you when you attempted it. This likely failed because when you use echo <sha1sum> you introduced an additional character, a newline (\n) which altered the checksum string.

When echoing strings to any of the hash functions like md5 or sha256sum it's generally best to do an echo -n <..> which tells echo to omit appending a newline at the end of the string.

You can see how this can influence any calls to a hash function like so:

$ echo "blah" | sha256sum
41af286dc0b172ed2f1ca934fd2278de4a1192302ffa07087cea2682e7d372e3  -

$ echo -n "blah" | sha256sum
8b7df143d91c716ecfa5fc1730022f6b421b05cedee8fd52b1fc65a96030ad52  -

The true hash of the string 'blah' is the 2nd call.

Answer 3

Looks like you're checking matches. Did you consider using the -c (--check) option to sha256sum?

Answer 4

Good idea @Sasha. Folks, pay attention that you need to put two spaces between $1 and $2.

sha256() { echo "$1  $2"|sha256sum -c; }

For an one shot solution, you could use:

echo "<expected-sha-256-sum>  <name-of-the-file>" | sha256sum -c 

Again, it's important having two spaces between "expected-sha-256-sum" and "name-of-the-file".

Answer 5

You can do it in one line like this:

On Linux:

check=$(sha256sum -b linuxmint-20.2-cinnamon-64bit.iso); check_escaped_space=$(echo $check | sed 's/ / \\/'); grep $check_escaped_space mint_sha256sum.txt -n

On Mac:

check=$(shasum -a 256 -b linuxmint-20.2-cinnamon-64bit.iso); check_escaped_space=$(echo $check | sed 's/ / \\/'); grep $check_escaped_space mint_sha256sum.txt -n

I used mint_sha256sum.txt as a file of correct hashes to check from like they give for https://linuxmint.com/edition.php?id=288 here https://ftp.heanet.ie/mirrors/linuxmint.com/stable/20.2/sha256sum.txt, it should give output

2:50b833f1f093c029bfb7ba6148c9ce96619c01a83e92f35287983fbd62f26b01 *linuxmint-20.2-cinnamon-64bit.iso

which indicates that it matched line 2 in the .txt file.

If you don't have the hash value file and just have the expected hash then you can just put the hash in a file with a space then star and the name of the file you're checking, or so it's like the expected output of the sha256sum command.

On the website you were downloading from it says to check it like this:

Linux:

echo "50b833f1f093c029bfb7ba6148c9ce96619c01a83e92f35287983fbd62f26b01 *linuxmint-20.2-cinnamon-64bit.iso" | sha256sum --check

Mac:

echo "50b833f1f093c029bfb7ba6148c9ce96619c01a83e92f35287983fbd62f26b01 *linuxmint-20.2-cinnamon-64bit.iso" | shasum -a 256 --check

Answer 6

One Liner:

echo `cat <sha256_file_name>` | sha256sum -c

don't forget the quotes around cat statement