Example files

Article: https://youdozi.github.io/en/posts/2026-10-30-verify-sha256-download/

Extract into a new empty directory and run commands from that directory.

Environment
Python 3.11 or later; commands use a POSIX shell. Standard library only.

Commands
python3 make-samples.py
expected='ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad'
python3 verify-sha256.py "$expected" sample.bin
python3 verify-sha256.py "$expected" changed.bin
printf 'exit=%s\n' "$?"

Scope
Local fixture bytes abc and abcd, without network access or binary installation. The second verification intentionally prints MISMATCH and returns 1. The final command prints exit=1. A matching checksum does not authenticate a publisher or establish software safety.

Read the article for outputs, conditions and failure cases. PROVENANCE.json records the source and file hashes; hashes establish identity, not correctness.
