# How to add file integrity verification (corru\[ted disk?)

**URL:** <https://hub.mender.io/t/how-to-add-file-integrity-verification-corru-ted-disk/2679>\
**Category:** General Discussions\
**Created:** [October 16, 2020, 11:11am UTC](https://hub.mender.io/t/how-to-add-file-integrity-verification-corru-ted-disk/2679 "2020-10-16T11:11:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bender](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/bender/32/847_2.png) [@bender](https://hub.mender.io/u/bender)\
**Post date:** [October 16, 2020, 11:11am UTC](https://hub.mender.io/t/how-to-add-file-integrity-verification-corru-ted-disk/2679/1 "2020-10-16T11:11:43Z")

</div>

We recently decided to use Mender Professional for our RaspberryPi-based fleet updates and noticed that there is no check if the SD card is corrupted or something so we decided to implement this ourselves as Pi’s can suffer sometimes.  
We want to read back from disk from the inactive partition once the download is completed and verify file integrity.  
My questions specifically are:

1. Can we get the hash off the cloud server or the deployment?
2. Can we rerun the same hashing process from disk expected to produce the same hash?
3. Which script (location?) should we place this above code? Return values to allow/block the update?

I heard @kacf is the man for this 😉

---

<div class="post-metadata">

**Author:** ![kacf](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/kacf/32/146_2.png) [@kacf](https://hub.mender.io/u/kacf)\
**Post date:** [October 16, 2020, 12:30pm UTC](https://hub.mender.io/t/how-to-add-file-integrity-verification-corru-ted-disk/2679/2 "2020-10-16T12:30:06Z")

</div>

Unfortunately there is no way to get the hash from the server. Here’s what I would recommend: Prepare an `ArtifactInstall_Enter` state script, and inside it, define two values:

```bash
ROOTFS_IMAGE_CHECKSUM=0
ROOTFS_IMAGE_SIZE=0

```

In your build process, obtain the sha256sum checksum of the image, and its size, and replace them in `ArtifactInstall_Enter` like this:

```bash
sed -i -e "s/ROOTFS_IMAGE_CHECKSUM=.*/ROOTFS_IMAGE_CHECKSUM=<actual-checksum>/"
sed -i -e "s/ROOTFS_IMAGE_SIZE=.*/ROOTFS_IMAGE_SIZE=<actual-size>/"

```

And add it to the Artifact using the mender-artifact `-s` argument. The rest of the `ArtifactInstall_Enter` script should be reading the checksum from the inactive partition and comparing it to the checksum. Make sure you do not read more than `ROOTFS_IMAGE_SIZE` bytes; it’s common that the partition is a little bit larger than the filesystem.

If you make the replacing step part of your build process, then it should be relatively automatic.