When it comes to data security, you can never be too careful. That’s why measures such as
checksum verification are put in place to ensure that downloaded files have not been tampered with and that you have indeed gotten the files you intended to download. So what is checksum anyway?
A checksum is a small-sized datum from a block of digital data for the purpose of detecting errors which may have been introduced during its transmission or storage — Wikipedia
For the most part, checksum is used to make sure that a file is not corrupt. It’s good practice to verify downloaded files as it reduces risk of being victim to a number of cyber attacks. The verification is done by the help of algorithms. The most common ones are:
- Secure Hash Algorithms(SHA-1, SHA-2, SHA-256)
Most linux distributions have checksum generating programs pre-installed. Ubuntu for example comes bundled with
sha256sum which we will be using for the purpose of this tutorial.
How the verification process works
If the checksum generated by
sha256sum matches the one provided on the download page of a particular file, then you can be sure that your file is not corrupt. For this tutorial, we’ll be using the
iso image of Elementary OS to verify the checksum values.
The elementary OS Installation docs point out that the checksum output should be:
To verify our elementary os download, we would run:
sha256sum [path-to-downloaded-file]/elementaryos-0.4.1-stable.20180214.iso #depending on when you download the iso image, the name of the file might #differ from the one above
If the output is different from the one on the download page, then we have a problem. If not, then we can safely install our downloaded image.