user12375: I've been playing around learning more about Bitcoin and was following this tutorial from 21.co on digital signatures.
When I open the SHA256SUMS.asc file and try to verify the packages, I get different hashes than what's in the file.
curl -O https://bitcoin.org/bin/bitcoin-core-0.11.0.tar.gz

shasum -a 256 bitcoin-core-0.11.0.tar.gz

This gives the following output:
69b00985c84e6633cc2e518914436ce55666cc10d1edf15ee442758d9f8d5219  bitcoin-core-0.11.0.tar.gz

Which is very different from what is in the file:
c7a5e496d7c31bdc10d2c0c79dfcf9aca69f9520579917c7d3e95868b2127707  bitcoin-0.11.0-osx64.tar.gz

NOTE: I'm using a different command then what is mentioned in the tutorial for checking the hashes. shasum -a 256 instead of sha256sum.
Am I doing something wrong here?

user2306: You are hashing the 404 page returned by bitcoin.org. You can see this by running:
$ curl -s https://bitcoin.org/bin/file-does-not-exist | sha256sum
69b00985c84e6633cc2e518914436ce55666cc10d1edf15ee442758d9f8d5219  -
$ curl -s https://bitcoin.org/bin/file-does-not-exist2 | sha256sum
69b00985c84e6633cc2e518914436ce55666cc10d1edf15ee442758d9f8d5219  -

You should instead run
$ curl -O https://bitcoin.org/bin/bitcoin-core-0.10.0/bitcoin-0.10.0.tar.gz
$ sha256sum bitcoin-0.10.0.tar.gz # shasum -a 256 would also work

This gives me
a516cf6d9f58a117607148405334b35d3178df1ba1c59229609d2bcd08d30624  bitcoin-0.10.0.tar.gz

which is the SHA256SUM listed in the associated SHA256SUMS.asc file.

12375: <p>I've been playing around learning more about Bitcoin and was following <a href="https://21.co/learn/digital-signatures/#using-hashes-and-cryptographic-signatures-to-verify-data-integrity" rel="nofollow">this</a> tutorial from 21.co on digital signatures.</p>

<p>When I open the SHA256SUMS.asc file and try to verify the packages, I get different hashes than what's in the file.</p>

<pre><code>curl -O https://bitcoin.org/bin/bitcoin-core-0.11.0.tar.gz

shasum -a 256 bitcoin-core-0.11.0.tar.gz
</code></pre>

<p>This gives the following output:</p>

<pre><code>69b00985c84e6633cc2e518914436ce55666cc10d1edf15ee442758d9f8d5219  bitcoin-core-0.11.0.tar.gz
</code></pre>

<p>Which is very different from what is in the file:</p>

<pre><code>c7a5e496d7c31bdc10d2c0c79dfcf9aca69f9520579917c7d3e95868b2127707  bitcoin-0.11.0-osx64.tar.gz
</code></pre>

<p>NOTE: I'm using a different command then what is mentioned in the tutorial for checking the hashes. <code>shasum -a 256</code> instead of <code>sha256sum</code>.</p>

<p>Am I doing something wrong here?</p>
 2306: <p>You are hashing the 404 page returned by bitcoin.org. You can see this by running:</p>

<pre><code>$ curl -s https://bitcoin.org/bin/file-does-not-exist | sha256sum
69b00985c84e6633cc2e518914436ce55666cc10d1edf15ee442758d9f8d5219  -
$ curl -s https://bitcoin.org/bin/file-does-not-exist2 | sha256sum
69b00985c84e6633cc2e518914436ce55666cc10d1edf15ee442758d9f8d5219  -
</code></pre>

<p>You should instead run</p>

<pre><code>$ curl -O https://bitcoin.org/bin/bitcoin-core-0.10.0/bitcoin-0.10.0.tar.gz
$ sha256sum bitcoin-0.10.0.tar.gz # shasum -a 256 would also work
</code></pre>

<p>This gives me</p>

<pre><code>a516cf6d9f58a117607148405334b35d3178df1ba1c59229609d2bcd08d30624  bitcoin-0.10.0.tar.gz
</code></pre>

<p>which is the SHA256SUM listed in the associated <code>SHA256SUMS.asc</code> file.</p>
