How can I verify a checksum of a file by piping it? e.g. I want to do something like

curl -sL https://example.org/maybe-safe-maybe-not.tar.gz | md5sum 8da7904f495f682c39fa505b6404f9d1 | tar xvzC /usr/local/bin

Where md5sum or similar program will abort the pipeline if the given hash (as an arg) doesn't match, or forward the file outputs if it does match.

This would make my scripts a little more secure I think, because I can at least be sure I'm getting the version I tested with.

I can check the sum with a bit of hackery:

cat yarn.lock | md5sum -c <(echo 8da7904f495f682c39fa505b6404f9d1 -) --status

But I don't know how to forward the output of yarn.lock after that.

1 Answer 1


Download to the file name maybe-safe-maybe-not.tar.gz and then:

if [ "${expected_digest} -" = "$(md5sum <maybe-safe-maybe-not.tar.gz)" ]; then
    tar xvzf maybe-safe-maybe-not.tar.gz -C /usr/local/bin
    echo 'ERROR: ...'
    exit 1
  • Was hoping for something a little more compact, that didn't use temp files.
    – mpen
    Aug 3, 2020 at 2:20
  • @mpen I guess that's impossible because you have to read all the data before you can compute the digest. Aug 3, 2020 at 2:26
  • Hmm.. that's a good point, I wouldn't be able to stream it through but I could still load the whole thing into a buffer in memory.
    – mpen
    Aug 3, 2020 at 2:30
  • @mpen And that is better than a tmp file (in /dev/shm) how? Aug 3, 2020 at 2:42
  • Saves some disk IO. Faster to read from memory than a file. Also saves a bit of wear-and-tear on the disk.
    – mpen
    Aug 3, 2020 at 2:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .