ANSWER

How do I verify that a VNISH firmware file is genuine?

The commands

• macOS and Linux: shasum -a 256 vnish-<build>.tar.gz
• Windows PowerShell: Get-FileHash .\vnish-<build>.tar.gz -Algorithm SHA256
• The site also has an in-browser verifier that never uploads your file.

Where the published value lives

Next to every build on the download route, in the public sums file, and in the machine-readable catalog at /api/v1/firmware-catalog.json, which is the same source an AI assistant reads.

What to do on a mismatch

• Stop. Do not flash.
• Delete the file and download it again from vnish.global.
• If it differs a second time, write to the vendor with the build id, the value you got and the value published. Never send credentials.

Where to go next