<p>You are hashing the 404 page returned by bitcoin.org. You can see this by running:</p>

<pre><code>$ curl -s https://bitcoin.org/bin/file-does-not-exist | sha256sum
69b00985c84e6633cc2e518914436ce55666cc10d1edf15ee442758d9f8d5219  -
$ curl -s https://bitcoin.org/bin/file-does-not-exist2 | sha256sum
69b00985c84e6633cc2e518914436ce55666cc10d1edf15ee442758d9f8d5219  -
</code></pre>

<p>You should instead run</p>

<pre><code>$ curl -O https://bitcoin.org/bin/bitcoin-core-0.10.0/bitcoin-0.10.0.tar.gz
$ sha256sum bitcoin-0.10.0.tar.gz # shasum -a 256 would also work
</code></pre>

<p>This gives me</p>

<pre><code>a516cf6d9f58a117607148405334b35d3178df1ba1c59229609d2bcd08d30624  bitcoin-0.10.0.tar.gz
</code></pre>

<p>which is the SHA256SUM listed in the associated <code>SHA256SUMS.asc</code> file.</p>

CC BY-SA 3.0
2016-01-29T01:38:53.780Z
2016-01-29T01:38:53.780Z
Nick ODell
<p>I've been playing around learning more about Bitcoin and was following <a href="https://21.co/learn/digital-signatures/#using-hashes-and-cryptographic-signatures-to-verify-data-integrity" rel="nofollow">this</a> tutorial from 21.co on digital signatures.</p>

<p>When I open the SHA256SUMS.asc file and try to verify the packages, I get different hashes than what's in the file.</p>

<pre><code>curl -O https://bitcoin.org/bin/bitcoin-core-0.11.0.tar.gz

shasum -a 256 bitcoin-core-0.11.0.tar.gz
</code></pre>

<p>This gives the following output:</p>

<pre><code>69b00985c84e6633cc2e518914436ce55666cc10d1edf15ee442758d9f8d5219  bitcoin-core-0.11.0.tar.gz
</code></pre>

<p>Which is very different from what is in the file:</p>

<pre><code>c7a5e496d7c31bdc10d2c0c79dfcf9aca69f9520579917c7d3e95868b2127707  bitcoin-0.11.0-osx64.tar.gz
</code></pre>

<p>NOTE: I'm using a different command then what is mentioned in the tutorial for checking the hashes. <code>shasum -a 256</code> instead of <code>sha256sum</code>.</p>

<p>Am I doing something wrong here?</p>

<signature>
Getting the wrong hashes for bitcoin core packages
Prem Govind
# Getting the wrong hashes for bitcoin core packages

(Asked by: username_0 on 2016-01-29)

I've been playing around learning more about Bitcoin and was following [this](https://21.co/learn/digital-signatures/#using-hashes-and-cryptographic-signatures-to-verify-data-integrity) tutorial from 21.co on digital signatures.

When I open the SHA256SUMS.asc file and try to verify the packages, I get different hashes than what's in the file.

```
curl -O https://bitcoin.org/bin/bitcoin-core-0.11.0.tar.gz

shasum -a 256 bitcoin-core-0.11.0.tar.gz

```

This gives the following output:

```
69b00985c84e6633cc2e518914436ce55666cc10d1edf15ee442758d9f8d5219  bitcoin-core-0.11.0.tar.gz

```

Which is very different from what is in the file:

```
c7a5e496d7c31bdc10d2c0c79dfcf9aca69f9520579917c7d3e95868b2127707  bitcoin-0.11.0-osx64.tar.gz

```

NOTE: I'm using a different command then what is mentioned in the tutorial for checking the hashes. `shasum -a 256` instead of `sha256sum`.

Am I doing something wrong here?

**Tags:** signature


---

## 1 answers

### Answer by username_1 on 2016-01-29. Score: 3

You are hashing the 404 page returned by bitcoin.org. You can see this by running:

```
$ curl -s https://bitcoin.org/bin/file-does-not-exist | sha256sum
69b00985c84e6633cc2e518914436ce55666cc10d1edf15ee442758d9f8d5219  -
$ curl -s https://bitcoin.org/bin/file-does-not-exist2 | sha256sum
69b00985c84e6633cc2e518914436ce55666cc10d1edf15ee442758d9f8d5219  -

```

You should instead run

```
$ curl -O https://bitcoin.org/bin/bitcoin-core-0.10.0/bitcoin-0.10.0.tar.gz
$ sha256sum bitcoin-0.10.0.tar.gz # shasum -a 256 would also work

```

This gives me

```
a516cf6d9f58a117607148405334b35d3178df1ba1c59229609d2bcd08d30624  bitcoin-0.10.0.tar.gz

```

which is the SHA256SUM listed in the associated `SHA256SUMS.asc` file.


---

