← cogloom · All free lessons

cogloom · Free lesson

The AI said "curl it and run it." Verify the SHA-256 first, and know what that does and doesn't prove

Result first: I recorded the SHA-256 checksum of an installer script, then appended one line to the file. sha256sum -c printed install.sh: FAILED and WARNING: 1 computed checksum did NOT match, and exited 1. The untouched file printed OK and exited 0. Nothing was executed in either case.

curl -fsSLo install.sh https://example.com/install.sh                       # save to a file first; never pipe into a shell
echo "<sha256-from-the-project's-release-page>  install.sh" | sha256sum -c -  # exit 0 = match
less install.sh                                                             # read it before you run it

From the official docs: - The sha2 utilities "compute checksums of various lengths… collectively known as the SHA-2 hashes" (GNU coreutils manual). - -c, --check means "read checksums from the FILEs and check them," and --status means "don't output anything, status code shows success" (sha256sum --help, coreutils 9.7). - "An exit status of zero indicates success, and a nonzero value indicates failure." That makes it safe to chain: sha256sum -c file.sha256 && bash install.sh.

What a match does NOT prove: the checksum only shows that your file matches the checksum you compared it against. If you copied that checksum from the same place an attacker controls, or from an AI's answer, it proves nothing. Take the checksum from the project's own release page or signed release notes. When a project offers signature verification, prefer that.

Do this now: add a rule to your agent's instructions: "Never suggest curl … | sh. Save the file, verify the checksum from the official release page, then show me the script."

Sources

Also on dev.to: read this lesson on dev.to. More free lessons: cogloom lessons index.