ASTi Logo

Application Note

Verify the Integrity of Downloaded Files (#138)

The ASTi File Transfer Portal is a standalone website that we use to electronically transfer files to our customers. Oftentimes, these downloads include large, multigigabyte software installation files. One problem with transferring files this big is that it's relatively time consuming. The longer a file takes to send, the higher the chance something can go wrong.

That's why ASTi generates checksums for its software installation files, enabling you to verify the integrity of the files that you download. Failure to do so may cause you to waste a lot of time troubleshooting installation issues. As a matter of fact, ASTi personnel responsible for placing files on the ASTi File Transfer Portal routinely verify file checksums to ensure their integrity before releasing them to customers.

Checksums

A checksum is a unique string of characters that serves as a fingerprint representing all the contents of a single file. A checksum utility (or program) generates this string by adding up every bit/byte of the file and running that through a cryptographic function to output a text value. If you perform the same operation on two copies of the same file using the same crypto function, you can confirm that those copies are identical if their checksums are the same.

At ASTi headquarters, we generate a checksum each time we build a fresh, new file. You can inspect any subsequent copy of that file to ensure it is identical using its checksum. Here's how to do it.

Verify your Download

First, download the file from the ASTi File Transfer Portal. If you don't have an account, contact your favorite ASTi support representative to get one. The delivery includes the checksum for that file as a separate plain-text file. For example, you may see two similar files available for download in the portal:

  • ASTi_software_release_X.Y.Z.iso
  • ASTi_software_release_X.Y.Z.iso.sha256

That .sha256 extension tells you that it's the text file containing the checksum value for the corresponding .iso file. It also tells you that ASTi used the SHA-256 crypto algorithm to generate the checksum. ASTi includes the checksum file for larger installation files (e.g., Voisus, Telestra, SERA, Redsim, Solo) but not every file. License files, support documentation, models, and scenarios likely won't include an accompanying checksum text file.

An SHA-256 checksum looks like this: 97e154b9cee994e0903b1959418c8b009b009f1d7a208f84270c5ea3067b92d6

Using a Windows Computer

From the terminal prompt, run certutil -hashfile {file_path} SHA256 (e.g., certutil -hashfile C:\Users\user1\Downloads\asti_software.iso SHA256).

Your computer will churn for a bit while doing some math and then display its result. Compare that result to the contents of the text file, which you can Open with Notepad, or run type {checksum_file_path} at the prompt.

If the text strings are the same, rest easy knowing that your ASTi file is undamaged and safe to use.

Using a Linux Computer

Make sure your file and its checksum text file are in the same directory. Next, in the terminal, run sha256sum -c {checksum_file_path} (e.g., sha256sum -c /home/user1/Downloads/asti_software.iso.sha256).

This command reads the checksum text file to find the binary file's name and runs the algorithm on it. The result is “OK” if everything looks good or “FAILED” if the computed checksum value differs from the text value in the .sha256 file.

Troubleshooting

If the checksums don't check out (sorry), then attempt your download from the ASTi File Transfer Portal again. If the second integrity check doesn't pass, contact ASTi Support at support@asti-usa.com to alert us of this problem. We'll do everything possible to remedy the situation quickly.