Is it possible to get the SHA-256 of an uploaded file?

[cybertrapped3]

Hello,

After I file has been uploaded to GitHub, is it possible to get the SHA-256 hash? If yes, how?

Thanx

[github-actions[bot]]

Thank you for your interest in contributing to our community! We currently only accept discussions created through the GitHub UI using our provided discussion templates. Please re-submit your discussion by navigating to the appropriate category and using the template provided.

This discussion has been closed because it was not submitted through the expected format. If you believe this was a mistake, please reach out to the maintainers.

[rjsgud49]

Depends on where the file was uploaded.

Release asset (a file attached to a release): GitHub already computes it. On the release page each asset shows a sha256: digest, and the REST API returns it in the digest field:

curl -s https://api.github.com/repos/OWNER/REPO/releases/latest \
  | jq '.assets[] | {name, digest}'

I checked this against cli/cli's latest release: the digest value matched sha256sum of the downloaded file.

File committed to a repo: GitHub doesn't show a SHA-256 for these. The sha you see in the API (/repos/OWNER/REPO/contents/PATH) is the git blob id, which is SHA-1 of blob <size>\0<content>, so it won't match sha256sum. You can check that locally with git hash-object FILE. To get the SHA-256, download the raw file and hash it:

curl -sL https://raw.githubusercontent.com/OWNER/REPO/BRANCH/PATH | sha256sum
# macOS: shasum -a 256
# Windows PowerShell: Get-FileHash .\file -Algorithm SHA256