Re: Curl feature idea, download hash checking

  This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.

---39887073-623848600-1781262983=:3589465
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8BIT

On Fri, 12 Jun 2026, Ian Norton via curl-users wrote:

> curl -O URL —-hash sha256:HASH_VALUE​
>
> Does this sound like a good idea?

It is an idea that is often brought up but has never been materialized. Is it 
good? I think it depends on how it is done so that in the end people would use 
it.

One additional idea is adding the hash into the URL itself somehow so that 
copy and pasting a single URL is enough and you can't forget the hash:

   curl -O URL https://host.com/HASHMARKER-HASH/the/path/file.tar.gz

It also makes the URL not work at all if the download tool doesn't support the 
hash, which I think is a bonus.

Doing the hash embedded in the URL is of course a side-track, can be worked on 
independently and is for sure hard to do with buy-in from others as well.

Others have suggested a similar thing before but instead of just doing a hash 
it would verify the *signature* provided.

Challenges involved include:

What if you download to stdout and yet want it verified? Like in the classic: 
"curl https://installer.example.com | sh" case. It seems like that case is 
still a decent amount of current use cases this could help strengthen.

Then curl needs to download to a temporary location, check the hash and *then* 
pass it on. This can lead to challenges if you instead for example pipe a 
petabyte stream: "curl https://never-ending.example.com | videoplayer"

-- 

  / daniel.haxx.se || https://rock-solid.curl.dev
---39887073-623848600-1781262983=:3589465
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-users
Etiquette:   https://curl.se/mail/etiquette.html

---39887073-623848600-1781262983=:3589465--