Check File Integrity with cksum on Linux

By the end of this guide you will be able to create a checksum for a file, compare it with a published value, and verify a whole checksum list with GNU cksum. The examples use the installed GNU coreutils 9.4 command and take about five minutes. You need a shell, read access to the files, and a trusted checksum value if you are checking a download. No elevated privileges are required.

1. Check the installed command

Confirm which implementation and version you are using before copying an example into a script. This matters because the options and output formats described here are from GNU coreutils 9.4.

cksum --version

Expected output starts like this:

cksum (GNU coreutils) 9.4

2. Create a checksum

Pass one or more file names to cksum. With no file, or with -, it reads standard input. The default is a 32-bit CRC checksum, which is useful for detecting accidental changes but is not a good choice for security-sensitive authenticity checks.

cksum /path/to/download.iso

For a file called download.iso, output has three fields: the checksum, the file size in bytes, and the name.

3829065099 1048576 /path/to/download.iso

The command only reads the file. It does not alter the file or require root. If a name contains spaces, quote it:

cksum "/path/to/backup image.iso"

To checksum text or another program's output, pipe it to standard input:

printf '%s\n' 'example input' | cksum

Do not confuse a checksum with encryption. Anyone who can replace both a file and its checksum can make a new matching pair.

3. Choose a digest for security checks

Use --algorithm=TYPE when a supplier publishes a named digest. GNU cksum supports md5, sha1, sha224, sha256, sha384, sha512, blake2b, sm3, and the legacy sysv, bsd, and crc forms. For a new integrity workflow, SHA-256 is a reasonable interoperable choice when that is what the publisher provides.

cksum --algorithm=sha256 /path/to/download.iso

GNU's tagged output identifies the algorithm and file:

SHA256 (/path/to/download.iso) = 4d810e9e8017aaccc2573e3925be756cf8dae6edc80f5faaa6abc7e537c433a5

Use the algorithm named by the source you trust. A SHA-256 value cannot be compared with an MD5 value, even for the same file. The --base64 option changes the digest encoding from hexadecimal to base64; it does not change the digest itself.

4. Verify a published checksum

Suppose a trusted release page gives you the SHA-256 value. Store that value in a file only if you have checked the value's provenance, then compare the file you downloaded with it. The simplest manual check is to run the command and compare the digest after the equals sign character by character.

cksum --algorithm=sha256 /path/to/download.iso

A single changed byte produces a different digest. Do not accept a near match, a value for a different algorithm, or a value copied from an untrusted mirror. If the value does not match, discard or quarantine the download and obtain it again from a trusted source. Do not overwrite the original until you understand the failure.

5. Verify a checksum file

The more useful repeatable form is a checksum list produced by cksum or an equivalent standalone checksum program. Generate one with the same algorithm, then pass it to --check:

cksum --algorithm=sha256 /path/to/download.iso > /path/to/download.sha256
cksum --check /path/to/download.sha256

For a valid entry, the result is similar to:

/path/to/download.iso: OK

In practice, the checksum list normally comes from the release publisher rather than from the same machine that downloaded the file. If the list uses a relative file name, run the check from the directory the list expects, or inspect the list before running it. A filename with spaces or unusual characters can also make a hand-written list ambiguous.

For scripts, use the exit status instead of parsing normal output:

if cksum --check --status /path/to/download.sha256; then
    printf '%s\n' 'checksum verified'
else
    printf '%s\n' 'checksum failed' >&2
    exit 1
fi

--status prints nothing; success or failure is reported through the exit status. Add --quiet when you want failures reported but do not want an OK line for every successful file. Add --ignore-missing only when missing files are deliberately outside the check. Otherwise, a missing file should fail the check.

6. Handle malformed lists and unusual output

When consuming a list from another tool, --warn reports improperly formatted lines. --strict makes improperly formatted checksum lines contribute to a non-zero result. These options are useful at a boundary where a malformed or truncated list must not be silently accepted.

cksum --check --warn --strict /path/to/download.sha256

For machine-to-machine records, --zero terminates each output record with a NUL byte and disables filename escaping. This is safer than newline-delimited parsing when filenames can contain newlines, but the receiving program must understand NUL-delimited input.