Re: Curl feature idea, download hash checking

Ray Satiro via curl-users <[email protected]> Sat, 13 Jun 2026 09:24:59 -0400
Newsgroups	gmane.comp.web.curl.general
Message-ID	<[email protected]>
This is a multi-part message in MIME format.
--===============1168690244427682238==
Content-Type: multipart/alternative;
 boundary="------------1DbZ6pJ299i88rI27HBOsWn5"
Content-Language: en-US

This is a multi-part message in MIME format.
--------------1DbZ6pJ299i88rI27HBOsWn5
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

On 6/12/2026 7:16 AM, Daniel Stenberg via curl-users wrote:
> On Fri, 12 Jun 2026, Ian Norton via curl-users wrote:
>
>> curl -O URL —-hash sha256:HASH_VALUE
>>
>> Does this sound like a good idea?
>
> It is an idea that is often brought up but has never been 
> materialized. Is it good? I think it depends on how it is done so that 
> in the end people would use it. 


Many years ago I wrote CURLOPT_SHA256 / CURLINFO_SHA256 to calculate the 
hash of the transfer body as received but there wasn't any interest so 
it wasn't adopted see https://github.com/curl/curl/issues/1399

These days sha256 is more common and we have sha256 calculation code 
already in libcurl. So that part would be easier. But to handle 
partially downloaded data, resumed data, etc, is still a complication. 
You can already pipe curl to sha256 for verification, and ghedo gives an 
example in that issue of how to do it.

Basically if you can do the unix pipe style to an existing tool that can 
handle it then is it worth putting that tool's functionality in curl, I 
guess is the question. What I mean is like grep should be grep, curl 
should be curl etc

--------------1DbZ6pJ299i88rI27HBOsWn5
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <div class="moz-cite-prefix">On 6/12/2026 7:16 AM, Daniel Stenberg
      via curl-users wrote:<br>
    </div>
    <blockquote type="cite"
      cite="mid:[email protected]">On Fri, 12
      Jun 2026, Ian Norton via curl-users wrote:
      <br>
      <br>
      <blockquote type="cite" style="color: #007cff;">curl -O URL —-hash
        sha256:HASH_VALUE
        <br>
        <br>
        Does this sound like a good idea?
        <br>
      </blockquote>
      <br>
      It is an idea that is often brought up but has never been
      materialized. Is it good? I think it depends on how it is done so
      that in the end people would use it.
    </blockquote>
    <p><br>
    </p>
    <p>Many years ago I wrote CURLOPT_SHA256 / CURLINFO_SHA256 to
      calculate the hash of the transfer body as received but there
      wasn't any interest so it wasn't adopted see
      <a class="moz-txt-link-freetext" href="https://github.com/curl/curl/issues/1399">https://github.com/curl/curl/issues/1399</a></p>
    <p>These days sha256 is more common and we have sha256 calculation
      code already in libcurl. So that part would be easier. But to
      handle partially downloaded data, resumed data, etc, is still a
      complication. You can already pipe curl to sha256 for
      verification, and ghedo gives an example in that issue of how to
      do it.</p>
    <p>Basically if you can do the unix pipe style to an existing tool
      that can handle it then is it worth putting that tool's
      functionality in curl, I guess is the question. What I mean is
      like grep should be grep, curl should be curl etc<br>
    </p>
  </body>
</html>

--------------1DbZ6pJ299i88rI27HBOsWn5--

--===============1168690244427682238==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-users
Etiquette:   https://curl.se/mail/etiquette.html

--===============1168690244427682238==--