Tools · Python and Bash for security automation · 26 / 26
A printed digest is not a verdict
A SHA-256 line is the digest of bytes the script hashed. Quote it as a digest, not as a verdict.
The line is a digest and a path
A hashing script prints an algorithm name, a path, and a hex digest. The digest is the fingerprint it computed for the bytes it read. The line does not say the file is trusted, blocked, or unknown to anyone else.
This page does not send the digest to a lookup service. The reading stops at the line.
The path is the path it printed
The path on the line is the path the script printed, which may be relative. It identifies the argument in this output. It is not a verdict, and a second path with a different digest is a second line.
If the script hashed only part of a file, the output has to say so. If it does not, do not shrink or grow the claim. You have the digest it printed for the path it printed.
What belongs in the ticket
Copy the algorithm, the path, and the digest. Write that no verdict was printed. Do not add clean, malicious, or allowed because the line existed or because the process exited 0.
Lab: a digest filed as clean
A lab run prints sha256 lab-notes.txt and a 64-character hex string, then exits 0. A draft says lab-notes.txt is clean because a digest was printed and the status was 0.
The note quotes the algorithm, the path, and the digest as printed. Exit 0 is only the process status. No verdict word was on the line. Nothing is submitted to a lookup service.
stdout: sha256 lab-notes.txt <64 hex chars, as printed> exit status: 0 verdict word: none lookup: not done write: algorithm, path, digest not: clean
Diagram
What a hash line is allowed to say
The digest identifies bytes the script read. It does not grade them.
The line
sha256 lab-notes.txt <digest as printed>
Algorithm, path, and digest.
The status
exit 0
The process finished under its rules.
Not on the line
clean / malicious / allowed
Those words were not printed.
Check yourself
1. A script prints sha256, a path, and a hex digest. What is the hex string?
2. The same run exits 0. What does the 0 add?
3. The line has no word such as clean or malicious. What do you add?