File Fingerprints

A file can keep the same name after someone changes its contents. A fingerprint lets you compare the contents instead of trusting the name.

Lumen uses SHA-256 to calculate a fingerprint. You do not need to calculate it yourself. Inspect the file used by the practice helper:

seclab inspect artifacts demo-helper

You should see:

demo-helper:
  Machine: practice-laptop
  Path: /opt/lumen/demo-helper
  Contents: destination=parcel-cache.test
source=training-records.csv
  Last changed: 2026-11-01 08:57:00
  Expected SHA-256: 40f7e972c40034c1924e56ccbdeabaa292af38232f2f65882a1ae5ab81f34906
  Quarantined: no
  SHA-256: 6f98780313fed4bcc07f7a6adcf6dd348fc56606d1ae6b8d78a0b059cb9943e7

SHA-256 is the file’s current fingerprint. Expected SHA-256 is the fingerprint from its approved version. These two values differ, so this file has changed. Its contents also name an outside destination.

A different fingerprint is a reason to investigate, not proof of an attack. A normal update changes it too. Compare the change record, the file contents and the program’s connections before deciding.

Record the file’s ID, rather than copying its long fingerprint:

seclab answer file demo-helper

You should see:

Recorded your answer to file.