Pinned download: A SHA-256 and a verify-then-run snippet for any install script
Paste the public URL of an install script or binary that your pipeline or docs fetch with curl. Get its SHA-256 and a ready snippet for shell, GitHub Actions, GitLab CI or a Dockerfile that downloads the file, checks the hash and only then runs it.
What it does
- Replaces curl | sh with download, verify, run
- Snippets for shell, GitHub Actions, GitLab CI and Dockerfile
- Says whether the vendor publishes a checksum or signature next to the file
- Warns when the URL has no version in it, or returns a web page
- Shareable result link
What goes in, what comes out
- What goes in
- The public https URL of an install script or binary.
- What comes out
- The file's SHA-256, its size and kind, notes (no version in the URL, a web page came back, a checksum or signature file sits next to it), and a snippet for shell, GitHub Actions, GitLab CI or a Dockerfile that downloads, verifies and only then runs it.
- Example
- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh gave SHA-256 abdb525ee9f5b48b34d8ed9fc67c6013fb0f659712e401ecd88ab989b3af8f53 for a 16,563 byte bash script on 14 October 2026.
- Limits
- Files up to 60 MB, 40 seconds per download, 20 checks a day per IP address without an account. The file is hashed as it streams and is not stored. The hash says the file is the same next time; it does not say the file is safe.