How to verify checksum of a Patch/Software Download

What is MD5 checksum?

MD5 stands for Message-Digest algorithm 5. The MD5 algorithm takes as input a message of random length and produces as output a 128-bit "fingerprint" or "message digest". By comparing the MD5sum of the input (the file to be downloaded) and the output (the downloaded file), the integrity of the download can be verified.


What is SHA-1 checksum?

SHA stands for Secure Hash Algorithm. There are five algorithms in SHA, denoted by SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512. SHA-1, like MD5, is another algorithm that is used to verify data integrity. The main difference between the two algorithms is that while MD5 uses 128bits to produce a message digest, SHA-1 uses 160 bits.

Whenever you download any file from Internet or from Oracle Technology Network or Oracle support it is important to ensure that the file did not get corrupt during the download. This can be achieved by comparing the MD5 and/or SHA-1 checksum as shown below:

Once you download a file, the SHA-1 and MD5 should match that of the source. If they do not match, it is required to download the file again.

Linux
Calculating MD5 checksum in Linux:


The command is,

$md5sum absolute_path_of_file_name

Here, file_name is the complete location of the downloaded file.

Example of calculating MD5 checksum in Linux:

$md5sum /home/oracle/test.zip

a34d8cd98f00cf24e9800998ecf823e4 /home/oracle/test.zip

Calculating SHA-1 checksum in Linux:

Here, file_name is the complete location of the downloaded file.

$sha1sum complete_path_of_file_name

Example of calculating SHA-1 checksum in Linux:

$sha1sum /home/oracle/test.zip

a34d8cd98f00cf24e9800998ecf823e4 /home/oracle/test.zip

Solaris
Solaris does not ship with md5sum installed.

For Solaris 8 and 9:
md5sum, sha1sum utilities are included in the GNU 'coreutils' package available at www.sunfreeware.com

For Solaris 10:
'digest' utility must be installed.

Calculating MD5 checksum in Solaris 10:

The digest utility calculates the message digest of the given file(s) or stdin using the algorithm specified.

$ digest -v -a md5 absolute_path_of_file_name

Here, file_name is the complete location of the downloaded file.

Example of calculating MD5 checksum in Solaris 10:

$ digest -v -a md5 /home/oracle/test.zip

md5 /home/oracle/test.zip = a34d8cd98f00cf24e9800998ecf823e4

Calculating SHA-1 checksum in Solaris 10:

Specify the algorithm to be used in the digest utility.

$/usr/bin/digest -v -a sha1 complete_path_of_file_name

Here, file_name is the complete location of the downloaded file.

Example of calculating SHA-1 checksum in Solaris 10:

$/usr/bin/digest -v -a sha1 /home/oracle/test.zip

sha1 (/home/oracle/test.zip) = a34d8cd98f00cf24e9800998ecf823e4

Calculating MD5 and SHA-1 checksum in AIX:

For MD5:

csum

For SHA-1:

csum -h SHA1

Example of MD5 and SHA-1 checksum utility on AIX:

MD5:

:csum p8202632_10205_AIX64-5L_1of2.zip

1b58a3f5478fbdf9c660fcce5f9558cb p8202632_10205_AIX64-5L_1of2.zip

SHA-1:

:csum -h SHA1 p8202632_10205_AIX64-5L_1of2.zip

be78759fe031cd3a59b8490ee1d27b1ca321dd8f p8202632_10205_AIX64-5L_1of2.zip


Calculating MD5 and SHA-1 checksum in Windows:

Microsoft offers a tool called the File Checksum Integrity Verifier utility, available for download from Microsoft Technet within Knowledge Base article number 841290. This utility can be used on Windows to verify the integrity of the downloaded file. The syntax is:

fciv.exe -both downloaded_filename

For example, these are the results for an opatch download from Metalink:

fciv -both p2617419_10102_GENERIC.zip
//
// File Checksum Integrity Verifier version 2.05.
//
MD5 SHA-1
-------------------------------------------------------------------------
64f18de4aa1a41894cf08cddc1cd1dbc 276c2c529324744021f279d84cbb46c189896390

p2617419_10102_generic.zip