Hash FIle

[StableRax]

We have a customer who likes the Maintenance Solution script, however they will not allow software/files onto their system without a hash file, could this be generated on for the scripts and available on github.

[olahallengren]

Does anyone know if there is a standard for doing this? File format? Algorithm?

[Adilzaf]

SHA-256 is approved by NIST and is included in SHA-2 family of hash algorithms. You could use certUtil in cmd to generate the checksum, and then publish it on your website and Github. One could then verify the downloaded file by generating the same checksum locally. See below:

certUtil -hashfile C:\filename.sql SHA256

[olahallengren]

Could you help me understand the security aspects here?
If my website or GitHub repository were somehow compromised, an attacker could modify both the scripts and their checksums, couldn’t they?