Last updated: February 5, 2025
# Boost file integrity with B2sum for secure verification
**Tim Koschützki**
Co-founder · Berlin, Germany · Show bio
[](https://x.com/tim%5Fkos)[](https://github.com/tim-kos)
Data integrity breaches cost enterprises an average of $4.88 million per incident according to IBM's 2024 Data Breach Report. Modern development teams need robust tools to verify file authenticity and prevent tampering. The BLAKE2-based `b2sum` utility delivers superior performance and security compared to traditional hashing tools, making it an essential addition to development workflows.
## Why Blake2 matters for modern development
BLAKE2 provides significant advantages over legacy hashing algorithms. It is considered cryptographically secure and has been thoroughly reviewed by the cryptographic community. For compliance-critical applications, verify that BLAKE2 meets your regulatory requirements, as some standards may specifically require SHA-2 or SHA-3.
The `b2sum` implementation excels in:
* Validating software distributions
* Securing backup integrity
* Auditing CI/CD artifact chains
* Verifying encrypted transmissions
```bash
# Generate checksum for Ubuntu 24.04 live server iso (noble numbat)
b2sum ubuntu-24.04-live-server-amd64.iso > checksum.b2
# Verify against stored hash
b2sum -c checksum.b2
# Ubuntu-24.04-live-server-amd64.iso: ok
```
## Ci/cd integration: automated verification
Implement file verification in GitHub Actions:
```yaml
name: Verify Artifacts
on: [workflow_dispatch]
jobs:
verify:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Verify checksums
run: |
b2sum -c artifacts.b2
if [ $? -ne 0 ]; then
echo "Checksum verification failed" >&2
exit 1
fi
```
## Advanced verification patterns
Combine `b2sum` with other open source tools for enhanced workflows:
**Parallel Verification with Error Handling**
```bash
#!/usr/bin/env bash
set -euo pipefail
TMP_DIR=$(mktemp -d)
trap 'rm -rf "${TMP_DIR}"' EXIT
find /backups -type f -name "*.tar" | \
parallel --halt now,fail=1 \
"b2sum {} > '${TMP_DIR}/{/.}.b2' || echo 'Failed to hash: {}' >&2"
cat "${TMP_DIR}"/*.b2 > checksums.b2
```
**Python Integrity Checker with Retries**
```python
import subprocess
from pathlib import Path
def verify_file(file_path: Path, expected_hash: str, retries: int = 3) -> bool:
for attempt in range(retries):
try:
result = subprocess.run(
['b2sum', str(file_path)],
capture_output=True,
text=True,
check=True
)
actual_hash = result.stdout.split()[0]
return actual_hash == expected_hash
except subprocess.CalledProcessError as e:
if attempt == retries - 1:
raise RuntimeError(f"Failed to verify {file_path}: {e}")
continue
return False
```
## Performance benchmarks
|File Size|b2sum|sha256sum|md5sum|
|-|-|-|-|
|1GB|1.27s|2.14s|0.64s|
|10GB|12.7s|21.4s|6.4s|
|100GB|127s|214s|64s|
*Tested on a container with AMD EPYC 7763 CPU*
## Best practices for production use
1. **Store Hashes Securely**: Use encrypted storage for checksum files.
2. **Parallel Processing**: Leverage GNU Parallel for handling large datasets.
3. **Automated Alerts**: Integrate verification failures with your monitoring systems.
4. **Version Control**: Track checksum files alongside your source code.
5. **Error Recovery**: Implement retry mechanisms for network- or IO-related failures.
6. **Logging**: Maintain detailed audit logs of all verification activities.
## Additional considerations
### Backwards compatibility
Since `b2sum` is included in GNU coreutils, it is available by default on most Linux distributions. Most existing workflows that rely on traditional checksum utilities can often adopt `b2sum` with minimal modification. However, ensure that any integrated scripts and applications support BLAKE2 hashes if they enforce specific hash formats.
### Hash function comparison
|Tool|Security Level|Speed|Recommended Use Case|
|-|-|-|-|
|b2sum (BLAKE2)|High, modern standard|Fast|General-purpose file verification|
|sha256sum|High, standardized|Moderate|Cryptographic applications and data integrity|
|md5sum|Low, vulnerable|Very fast|Legacy systems—secure verification not advised|
While `md5sum` remains quick, its known vulnerabilities disqualify it for secure file verification. SHA-256 is reliable and secure but may be slower for processing large files. `b2sum` offers a well-balanced alternative by combining robust security with enhanced performance.
### Common pitfalls and troubleshooting
* Ensure files are fully transferred before generating checksums to avoid mismatches.
* Verify the integrity of stored checksum files to prevent issues during verification.
* In CI/CD pipelines, implement clear alerting mechanisms for checksum failures, enabling rapid issue resolution.
* When processing files in parallel, manage temporary storage carefully to prevent race conditions.
For teams handling media assets at scale, Transloadit's Media Cataloging service leverages `b2sum` to automatically generate and verify file hashes during processing. This ensures end-to-end integrity validation for uploaded content without additional developer effort.
\#file-integrity#hash-verification#open-source-tools#media-cataloging-service
### 👩💻 Join 20k+ developers
Sign up for our [monthly newsletter](/newsletters.md) to receive direct links to 3 exclusive tech — and 2 product updates. No less, no more.
Your email:
Get access
## File uploading and encoding. Made simple.
Transloadit streamlines file handling for developers, trusted by brands like Coursera and The New York Times. We’re known for a reliable API, top-notch support, and a strong commitment to open source, with projects like [Uppy](https://uppy.io) and [Tus](https://tus.io) setting standards in file processing.
[Sign up](/c/)[Book a Demo](https://survey.typeform.com/to/kRg47Xi5)
No credit card needed · 5 GB included in the free plan
Cancel anytime