Take the 2-minute tour ×

How can I ensure the correctness of a .tar.gz file I recently downloaded from a server?

share|improve this question
add comment

1 Answer 1

first and formost you can use tools to calculate a 'number' of that file that is specific to that file and that file only. that number is called 'digital hash' or 'digest':


so, use something like 'sha256' (better) or 'md5' (still usefull although under attack) tp calculate the hash. calculate it on the server and on your machine. compare the two. if they are identical, congratulations.

you find lots of hash-programs for free, eg.


  • if you can not calculate the digest of the file on the server, you can not be sure you downloaded all bits perfectly

  • sometimes you do not need to calculate the digest on the server since some folks provide this information and tell you about the digest. but be careful, you have to 'download' that information as well. so if someone sents you the wrong number AND tricks you into download the wrong (manipulated) file, than the digest is worthless.

  • if you want an easy way for your customers / clients to download something and you on the deploying end of the chain want to know if the customer (which are not always tech savy) downloaded the file correctly: use something other than .tar.gz. tarballs (.tar.gz) are streams of data with no means to really detect if there is coming more data. with containers such as .zip or .7z this is different since they contain the TOC (table of content) at the end of the file. if the customer downloads the .zip and misses some bytes at the end (timeout due slow connections) then the customer won't be able to open the file and has instant feedback. sometimes such containers offer to checksum the content so the user can check if the container 'looks' ok. in the end the only way to tell that you downloaded a bit-perfect copy of a file is to calculate it's digest as explained at the beginning.

share|improve this answer
add comment

Your Answer


