The hash match is two hashes of one literal

Lesson map

Lesson 13. Map, example, EX059.

flowchart TD
  B["One byte literal"] --> H1["sha256 hex digest"]
  B --> H2["sha256 hex digest again"]
  H1 --> E{"Are the hex strings equal?"}
  H2 --> E
  E -->|Yes| X["The check is True"]

Equal inputs produce equal digests. The digest itself is not printed.

Logical drawing

download = b"synthetic donate-form 3.2.4 release"
vendor side hashes that same literal
printed result: [x] hash matches vendor
printed hex digits: none

Learning outcomes

After this chapter, you should be able to:

Show that both sides hash one byte string.
Keep the digest off the page.
Refuse a signature, a fetched file, or a reproduced build.

13.1 `hashlib.sha256` runs twice on equal bytes. The page shows only a tick.

download is the literal b"synthetic donate-form 3.2.4 release". vendor_hash is hashlib.sha256 of that same literal, taken as hex. The check compares a fresh hex digest of download with vendor_hash. Because the byte strings are equal, the digests are equal, and the Boolean is True. The print is [x] hash matches vendor. No hex character is written to the output. Copying a digest into the lesson would add a value the run did not show.

The script never calls open, never reads a path, and never requests a page. The prose says Owen compared a download from the official plugin page with a vendor-published hash. That story is outside the literals. This file cannot fail the comparison unless one literal is edited, and the published file does not contain that edit. A match of two hashes of one string is what the construction guarantees. It is not evidence that a distant page was retrieved during the run.

Newman et al. (2022) describe Sigstore's signing. This script does not sign and does not check a signature. Lamb and Zacchiroli (2022) describe reproducible builds. Hashing one literal does not rebuild the plugin. Thompson (1984) describes a compiler that can mislead a later build. This file does not compile anything. Torres-Arias et al. (2019) describe in-toto layouts that record steps. The checklist is not such a layout. SLSA v1.0 is not scored. The tick remains a Boolean.

Lesson table; scroll horizontally to read all columns →

Object	Role in this file	Shown on the page?
The byte literal	Input to both digests	no
The hex digest	Compared, then discarded	no
`[x] hash matches vendor`	The Boolean, printed	yes
A signature or a certificate	Not computed	no

13.2 Worked example

Lesson table; scroll horizontally to read all columns →

Claim about the tick	Mechanism	Decision
The Boolean is true	Both sides hash one literal	Keep
The hex digest is absent	The print is the bracket line only	Keep
"The script fetched the vendor page."	No request is made	Refuse
"The tick is a Sigstore verification."	No signature is checked	Refuse

Synthetic case. The byte string is synthetic release text, not a plugin archive.

Errors and limits

Do not paste a digest the output never contained.

Apply

EX059 — One literal. The checklist ticks hash matches vendor. A classmate prints a hex digest, says the script downloaded the plugin, and calls the tick a signature check. What did the two sha256 calls receive, and what is printed?
Show marking criteria
Rubric: 3 = both calls receive b"synthetic donate-form 3.2.4 release"; the digests match by that equality; only the tick is printed; there is no fetch and no signature;; 2 = one literal, a tick, and no digest on the page;; 1 = one fact;; 0 = none.