## Chapter 13 — The hash match is two hashes of one literal ### Lesson map Lesson 13. Map, example, EX059. ```mermaid flowchart TD B["One byte literal"] --> H1["sha256 hex digest"] B --> H2["sha256 hex digest again"] H1 --> E{"Are the hex strings equal?"} H2 --> E E -->|Yes| X["The check is True"] ``` Equal inputs produce equal digests. The digest itself is not printed. ### Logical drawing ```text download = b"synthetic donate-form 3.2.4 release" vendor side hashes that same literal printed result: [x] hash matches vendor printed hex digits: none ``` ### Learning outcomes After this chapter, you should be able to: 1. Show that both sides hash one byte string. 2. Keep the digest off the page. 3. Refuse a signature, a fetched file, or a reproduced build. ### 13.1 `hashlib.sha256` runs twice on equal bytes. The page shows only a tick. `download` is the literal `b"synthetic donate-form 3.2.4 release"`. `vendor_hash` is `hashlib.sha256` of that same literal, taken as hex. The check compares a fresh hex digest of `download` with `vendor_hash`. Because the byte strings are equal, the digests are equal, and the Boolean is `True`. The print is `[x] hash matches vendor`. No hex character is written to the output. Copying a digest into the lesson would add a value the run did not show. The script never calls `open`, never reads a path, and never requests a page. The prose says Owen compared a download from the official plugin page with a vendor-published hash. That story is outside the literals. This file cannot fail the comparison unless one literal is edited, and the published file does not contain that edit. A match of two hashes of one string is what the construction guarantees. It is not evidence that a distant page was retrieved during the run. Newman et al. (2022) describe Sigstore's signing. This script does not sign and does not check a signature. Lamb and Zacchiroli (2022) describe reproducible builds. Hashing one literal does not rebuild the plugin. Thompson (1984) describes a compiler that can mislead a later build. This file does not compile anything. Torres-Arias et al. (2019) describe in-toto layouts that record steps. The checklist is not such a layout. SLSA v1.0 is not scored. The tick remains a Boolean. | Object | Role in this file | Shown on the page? | |---|---|---| | The byte literal | Input to both digests | no | | The hex digest | Compared, then discarded | no | | `[x] hash matches vendor` | The Boolean, printed | yes | | A signature or a certificate | Not computed | no | ### 13.2 Worked example | Claim about the tick | Mechanism | Decision | |---|---|---| | The Boolean is true | Both sides hash one literal | Keep | | The hex digest is absent | The print is the bracket line only | Keep | | "The script fetched the vendor page." | No request is made | Refuse | | "The tick is a Sigstore verification." | No signature is checked | Refuse | > **Synthetic case.** The byte string is synthetic release text, not a plugin archive. ### Errors and limits Do not paste a digest the output never contained. ### Apply - **EX059 — One literal.** The checklist ticks `hash matches vendor`. A classmate prints a hex digest, says the script downloaded the plugin, and calls the tick a signature check. What did the two `sha256` calls receive, and what is printed? *Rubric:* 3 = both calls receive `b"synthetic donate-form 3.2.4 release"`; the digests match by that equality; only the tick is printed; there is no fetch and no signature;; 2 = one literal, a tick, and no digest on the page;; 1 = one fact;; 0 = none. ### Continue studying — lesson 13 (chapter 13 of 20) [← Chapter 12](#ch-12) · [Course chapter index](../SUBJECTS.md) · [Chapter 14 →](#ch-14) Continue to the next authored lesson. ## Worked answers **EX059.** Both `sha256` calls hash `b"synthetic donate-form 3.2.4 release"`. The tick is that equality. The hex digest is not printed. The script does not fetch a page or check a signature.