0

How can I verify a checksum of a file by piping it? e.g. I want to do something like

curl -sL https://example.org/maybe-safe-maybe-not.tar.gz | md5sum 8da7904f495f682c39fa505b6404f9d1 | tar xvzC /usr/local/bin

Where md5sum or similar program will abort the pipeline if the given hash (as an arg) doesn't match, or forward the file outputs if it does match.

This would make my scripts a little more secure I think, because I can at least be sure I'm getting the version I tested with.

I can check the sum with a bit of hackery:

cat yarn.lock | md5sum -c <(echo 8da7904f495f682c39fa505b6404f9d1 -) --status

But I don't know how to forward the output of yarn.lock after that.

Improve this question
1

Download to the file name maybe-safe-maybe-not.tar.gz and then:

expected_digest='8da7904f495f682c39fa505b6404f9d1'
if [ "${expected_digest} -" = "$(md5sum <maybe-safe-maybe-not.tar.gz)" ]; then
    tar xvzf maybe-safe-maybe-not.tar.gz -C /usr/local/bin
else
    echo 'ERROR: ...'
    exit 1
fi
Improve this answer
8
  • Was hoping for something a little more compact, that didn't use temp files. – mpen Aug 3 '20 at 2:20
  • @mpen I guess that's impossible because you have to read all the data before you can compute the digest. – Hauke Laging Aug 3 '20 at 2:26
  • Hmm.. that's a good point, I wouldn't be able to stream it through but I could still load the whole thing into a buffer in memory. – mpen Aug 3 '20 at 2:30
  • @mpen And that is better than a tmp file (in /dev/shm) how? – Hauke Laging Aug 3 '20 at 2:42
  • Saves some disk IO. Faster to read from memory than a file. Also saves a bit of wear-and-tear on the disk. – mpen Aug 3 '20 at 2:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.