I've implemented something similar in a powershell script that checks a
downloaded file sha256 hash to verify it is listed in a PTI Trust Registry
(SAG-CTR).
This script is similar to what Google is doing with their new Transparency
Ledger lookup tools to verify trust in Android apps.
------------------
param(
[string]$LOC,
[string]$OFILE
)
curl $LOC -o $OFILE
$DNAID = (Get-FileHash .\$OFILE).Hash
$URL="https://softwareassuranceguardian.com/labellink/getTrustedProductLabel?ProductID="+$DNAID+"&html=1";
Start-Process $URL
---------------------------------------------
Here is an example to check that a self-signed digital certificate is listed as
trusted:
powershell -c "& { ./sagverify.ps1 -Loc
'https://github.com/rjb4standards/REA-Products/raw/refs/heads/master/DigitalCertificates/BCG-SIGNING-KEY-2030.cer'
-OFile test.fil}"
Thanks,
Dick Brooks
Active Member of the CISA Critical Manufacturing Sector,
Sector Coordinating Council – A Public-Private Partnership
Lifetime IEEE Member, #SBOM SIG member
https://businesscyberguardian.com/
-----Original Message-----
From: curl-users <[email protected]> On Behalf Of Ian Norton via
curl-users
Sent: Thursday, June 18, 2026 4:49 AM
To: [email protected]
Cc: Ian Norton <[email protected]>
Subject: Re: Curl feature idea, download hash checking
On Thu, 18 Jun 2026 at 09:38, Ian Norton <[email protected]> wrote:
> > On Fri, 12 Jun 2026, Daniel Stenberg via curl-users wrote:
> > > On Fri, 12 Jun 2026, Ian Norton via curl-users wrote:
> > > > curl -O URL —-hash sha256:HASH_VALUE
> > > Does this sound like a good idea?
<snip>
> I'm coming from a place where in my org I've already "solved" this
> use-case with a python app that will exit non-zero if it can't
> download, or if the thing it downloaded didn't have a matching digest.
> But of course, this is a python tool and requires all the associated
> deps (and isn't especially fast)
>
> I'll try to make a curl PR and also try out the different input/arg
> variations and see if I can find one that feels right.
I've just seen Bruce's PR. That's given me some more things to think about.
Perhaps what I/we actually want is a pipe/filter app that refuses to output if
the digest doesn't match
Ian
--
--
Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-users
Etiquette: https://curl.se/mail/etiquette.html
--
Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-users
Etiquette: https://curl.se/mail/etiquette.html
