I want to do something similar to Ubuntu's signed checksums in distribution and I'm currently stuck on the integrity part. The tutorial here covers most of what I'd like the process to look like (I've modified what I'm writing for Mac syntax since that's what I'm using): https://tutorials.ubuntu.com/tutorial/tutorial-how-to-verify-ubuntu

Unfortunately the distribution channel I'm using requires that the files are distributed unpacked; otherwise I would have just zipped them up into a tar file or whatever and performed checksums on that.

It's simple enough to generate the SHA256SUMS file for the files present: find * -type f -exec shasum -b -a 256 {} \; > SHA256SUMS (just would have to remove the sums of the sums files), and then the sums can be verified with shasum -c -a 256 SHA256SUMS

My concern is that this system only guarantees integrity of files that were present when the sums were generated; an attacker could add additional files and this system would not catch that.

Staying in-band, one option I thought of is to have the recipient run the same command to generate the sums in a new file and then run diff between the one they generated and the one I generated, but I fear some people might just run the typical verification command. If instead I included a script to run verification, any attacker would just change this script as well, and it also runs the risk of people ignoring the script and running the typical verification strategy.

It's seeming the best option so far is to have another distribution channel where things are tarred up, have a signed checksum for that file, and then to finish verification you would check the diff between the two file trees. Any other ideas?

1 Answer 1


Rather than designing such a system yourself, you might want to take advantage of an existing File Integrity checker such as Aide:

Aide creates a database from your filesystem and stores various file attributes like permissions, inode number, user, group, file size, mtime and ctime, atime, growing size, number of links and link name. When someone make changes in filesystem, then Aide compare the database against the real status of the system and report it to you.

You can configure it to watch the specific files and directories you care about, and notify you of changes.

For the Mac, Aide can be installed with Brew.

  • This is an interesting option, but I don't think it's a very viable solution for multiple reasoons. I'm not going to ask people to download software I've never heard of before, and it appears it doesn't support Windows (I know I didn't express this as a requirement originally). I'm also not really sure something intended to find changes due to a rootkit on a single machine will be as useful for ensuring integrity of files across two separate machines (do I make a publicly accessible database for each version I publish?).
    – jack
    Jan 10, 2020 at 17:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .