Check File Integrity with cksum on Linux

A download finishes and you have no idea if it arrived intact: cksum settles that in one command. This covers creating a checksum, verifying it against a trusted value, and checking a whole checksum list with GNU cksum, whether you want a quick CRC or a proper SHA-256. The examples use the installed GNU coreutils 9.4 command and take about five minutes. You need a shell, read access to the files, and a trusted checksum value if you're checking a download. No elevated privileges required.

1. Check the installed command

Confirm which implementation and version you're using before copying an example into a script; the options and output formats here are from GNU coreutils 9.4.

cksum --version

Expected output starts like this:

cksum (GNU coreutils) 9.4

2. Create a checksum

Pass one or more file names to cksum. With no file, or with -, it reads standard input. The default is a 32-bit CRC checksum: fine for catching accidental corruption, not a good choice for security-sensitive authenticity checks.

cksum /path/to/download.iso

For a file called download.iso, output has three fields: the checksum, the file size in bytes, and the name.

3829065099 1048576 /path/to/download.iso

The command only reads the file. It never alters it and never needs root. If a name contains spaces, quote it:

cksum "/path/to/backup image.iso"

To checksum text or another program's output, pipe it to standard input:

printf '%s\n' 'example input' | cksum

Don't confuse a checksum with encryption. Anyone who can replace both a file and its checksum can produce a new matching pair.

3. Choose a digest for security checks

Use --algorithm=TYPE when a supplier publishes a named digest. GNU cksum supports md5, sha1, sha224, sha256, sha384, sha512, blake2b, sm3, and the legacy sysv, bsd, and crc forms. For a new integrity workflow, SHA-256 is a reasonable, interoperable choice when that's what the publisher offers.

cksum --algorithm=sha256 /path/to/download.iso

GNU's tagged output identifies the algorithm and file:

SHA256 (/path/to/download.iso) = 4d810e9e8017aaccc2573e3925be756cf8dae6edc80f5faaa6abc7e537c433a5

Use the algorithm named by the source you trust. A SHA-256 value cannot be compared against an MD5 one, even for the same file. The --base64 option changes the digest's encoding from hexadecimal to base64; it does not change the digest itself.

4. Verify a published checksum

Say a trusted release page gives you the SHA-256 value. Store that value only if you've checked its provenance, then compare it against the file you downloaded. The simplest manual check is to run the command and compare the digest after the equals sign character by character.

cksum --algorithm=sha256 /path/to/download.iso

A single changed byte produces a completely different digest. Don't accept a near match, a value for a different algorithm, or a value copied from an untrusted mirror. If it doesn't match, discard or quarantine the download and get it again from a trusted source. Don't overwrite the original until you understand why it failed.

5. Verify a checksum file

The more useful, repeatable form is a checksum list produced by cksum or an equivalent standalone checksum program. Generate one with the same algorithm, then pass it to --check:

cksum --algorithm=sha256 /path/to/download.iso > /path/to/download.sha256
cksum --check /path/to/download.sha256

For a valid entry, the result looks like this:

/path/to/download.iso: OK

In practice, the checksum list normally comes from the release publisher, not from the same machine that downloaded the file. If the list uses a relative file name, run the check from the directory the list expects, or inspect the list before running it. A filename with spaces or unusual characters can make a hand-written list ambiguous too.

For scripts, use the exit status instead of parsing normal output:

if cksum --check --status /path/to/download.sha256; then
    printf '%s\n' 'checksum verified'
else
    printf '%s\n' 'checksum failed' >&2
    exit 1
fi

--status prints nothing; success or failure comes through the exit status alone. Add --quiet when you want failures reported but don't want an OK line for every successful file. Add --ignore-missing only when missing files are deliberately outside the check; otherwise a missing file should fail it.

6. Handle malformed lists and unusual output

When consuming a list from another tool, --warn reports improperly formatted lines, and --strict makes those lines contribute to a non-zero result. Both matter at a boundary where a malformed or truncated list must not be silently accepted.

cksum --check --warn --strict /path/to/download.sha256

For machine-to-machine records, --zero terminates each output record with a NUL byte and disables filename escaping. This beats newline-delimited parsing when filenames can contain newlines, but the receiving program has to understand NUL-delimited input.