ANSWER
How do I verify that a VNISH firmware file is genuine?
Short answerHash the downloaded archive locally and compare it, character by character, with the SHA-256 published next to the build. If a single character differs, delete the file and download it again.
The commands
- macOS and Linux: shasum -a 256 vnish-<build>.tar.gz
- Windows PowerShell: Get-FileHash .\vnish-<build>.tar.gz -Algorithm SHA256
- The site also has an in-browser verifier that never uploads your file.
Where the published value lives
Next to every build on the download route, in the public sums file, and in the machine-readable catalog at /api/v1/firmware-catalog.json, which is the same source an AI assistant reads.
What to do on a mismatch
- Stop. Do not flash.
- Delete the file and download it again from vnish.global.
- If it differs a second time, write to the vendor with the build id, the value you got and the value published. Never send credentials.
Where to go next