<!--
title: verify downloaded file integrity
domain: security
topic: Security
language: Python
source: snyk/cli
updated: 2023-08-11
url: https://awesomereviewers.com/reviewers/cli-verify-downloaded-file-integrity/
-->

Always verify the integrity of downloaded files before using them, especially in security-sensitive applications. At minimum, validate downloaded files using checksums (SHA256, etc.) provided by the source. For higher security requirements, implement cryptographic signature verification using GPG keys.

Hash verification should occur immediately after download and before caching or extraction:

```python
def download_and_verify(url, expected_hash, filepath):
    # Download file
    urllib.request.urlretrieve(url, filepath)
    
    # Verify hash
    with open(filepath, 'rb') as f:
        file_hash = hashlib.sha256(f.read()).hexdigest()
    
    if file_hash != expected_hash:
        os.remove(filepath)
        raise ValueError("File integrity check failed")
    
    return filepath
```

For critical applications, extend this with GPG signature verification using trusted public keys. This prevents supply chain attacks and ensures the authenticity of downloaded binaries, libraries, or configuration files.