Linux Basics: Checking File Integrity with SHA-256

A checksum is a value calculated from a file’s bytes. On Debian and Ubuntu, sha256sum can record that value and check whether the file still matches it later. This is useful after copying or restoring files.

Run mktemp -d, then use cd to enter the temporary directory it prints before creating the practice files.

Calculate a checksum

printf 'Practice document\n' > document.txt
sha256sum document.txt

6412ee047796e24bf25d81ed91a053c931386baaa8010e2d32c602269f6f8979  document.txt

The digest describes the contents, not the name, modification time, or permissions. Identical bytes produce the same digest even when stored under different filenames.

Save and verify it

sha256sum document.txt > SHA256SUMS
sha256sum -c SHA256SUMS

document.txt: OK

The first command creates a checksum list. The second checks the file against its recorded value.

Run verification from the directory containing these files. Relative filenames in the list are resolved from your current directory, not automatically from the checksum list’s location.

Keep the saved list unchanged when checking a copy. Recalculating it after a bad transfer would simply record the damaged file’s new checksum.

Detect a change

printf 'Another line\n' >> document.txt
sha256sum -c SHA256SUMS

document.txt: FAILED
sha256sum: WARNING: 1 computed checksum did NOT match

The warning is on standard error. Verification returns status 1. The check does not repair or remove the changed file.

For downloaded software, obtain the expected checksum through the publisher’s trusted channel. An attacker who replaces both a file and its checksum can make them agree. A checksum alone does not prove who published the file.

Reference

Debian sha256sum manual

Acknowledgements

This post was created with assistance from AI.

Linux Basics — lesson 15 of 25. Series index

Previous: Creating and Extracting tar Archives · Next: Checking System Information