Checksum verification of the installers (mac/windows)
Author: odockalCreated Sep 17, 2026Updated Sep 18, 2026
Labelsstatus/need-triageneeds-info
The aim of this issue to provide a test which can be run on a CI system and verifies the integrity of the built bits (installer artifacts).
Input is the checksum file (sha256sum). We also need to have either urls or bits downloaded in the test env. The test then performs verification per each file with given checksum file.
An example of bash script:
#!/bin/sh
# Verifies files in this directory against sha256sum.txt
set -e
DIR="$(dirname "$0")"
CHECKSUM_FILE="$DIR/sha256sum.txt"
if [ ! -f "$CHECKSUM_FILE" ]; then
echo "Error: $CHECKSUM_FILE not found" >&2
exit 1
fi
cd "$DIR"
sha256sum -c "$(basename "$CHECKSUM_FILE")"If this folder contains the sha256sum.txt and downloaded files, the output can look like this:
podman-desktop-1.1.3-arm64.dmg: OK
podman-desktop-1.1.3-setup-x64.exe: OKWe can of course consider vitest/playwright framework and run tests as part of existing suite. We can also have custom gh action which verifies the bits anytime we download installer from any source (release, prerelease).
Source: podman-desktop/podman-desktop