Verify with SHA1
Check that an installer you downloaded is exactly the one Microsoft published.
A SHA1 checksum is a fingerprint of a file. Change one byte and the fingerprint changes completely. MOFA publishes the SHA1 for every installer it tracks, so you can download a package, hash it, and compare. A match means the file arrived untouched.
Check a file you already have â
shasum -a 1 ~/Downloads/Microsoft_Word_16.114.pkgThe output is the checksum followed by the file name:
da39a3ee5e6b4b0d3255bfef95601890afd80709 Microsoft_Word_16.114.pkgDownload and verify in one go â
If you are scripting it, let shasum do the comparison. Paste the published checksum, two spaces, then the file name, and shasum reports OK or FAILED.
curl -L -o Microsoft_Word_16.114.pkg "https://go.microsoft.com/fwlink/?linkid=525134"
echo "da39a3ee5e6b4b0d3255bfef95601890afd80709 Microsoft_Word_16.114.pkg" | shasum -a 1 -cMicrosoft_Word_16.114.pkg: OKSwap in the checksum from the MOFA page for the file you downloaded. The one above is only an example. The two spaces between the checksum and the file name are required. That is the format shasum writes and the format it reads back with -c. The exit code is 0 on a match and 1 on a mismatch, so it slots straight into a deployment script.
Where to find the checksums â
SHA1 is older and no longer considered collision resistant. It is fine for spotting a corrupted download, but when a SHA256 is also published, check that one too. MOFA publishes both, and the SHA256 guide works the same way with -a 256.
Further reading â
Checksum does not match? Download the file again first. A partial or interrupted download is by far the most common cause.