Use content hashes to identify a reviewed downloadable artifact

By Batu · English technical notes

Also published in our Blogger archive.

Identify the artifact by its bytes

sha256 consumes the temporary artifact bytes, and hexdigest exposes a 64-character hexadecimal digest. The script checks that full width while printing a shorter display prefix. A verifier must compare the complete digest, not that abbreviated log value.

A filename cannot distinguish two different byte streams with the same name. For large artifacts, avoid read_bytes and stream the file or use hashlib.file_digest. A match still says nothing about who supplied the expected digest.

Example

from pathlib import Path
from tempfile import TemporaryDirectory
with TemporaryDirectory() as d:
    import hashlib
    p = Path(d) / 'artifact'
    p.write_bytes(b'synthetic-release-v1')
    h = hashlib.sha256(p.read_bytes()).hexdigest()
    assert len(h) == 64
    result = 'sha256=' + h[:12] + '...'
    print(result)

Expected stdout:

sha256=380f8f1d6b3a...

Sources

- hashlib.sha256

Prepared with AI assistance. The example uses synthetic data; its stated limits apply.