Use file checksums to identify the approved master

Record a trusted reference

After the exact master is approved, calculate its SHA-256 checksum using a trusted local tool. Save the algorithm, filename, file size, version and approval reference together. NIST’s Secure Hash Standard documents the hash family; the checksum must still be linked to the correct approved file.

Compare after transfer

Have the recipient calculate the same algorithm on the actual downloaded file and compare the complete result. A matching SHA-256 is strong evidence that the byte content matches the trusted reference. A shortened display or a matching filename alone is not the same check.

Understand a mismatch

Investigate a different export, incomplete transfer or file modification before proceeding. Metadata edits can change the file bytes even where the decoded audio appears the same. Do not assume a different checksum necessarily proves audible corruption, and do not overwrite the approved reference to make the comparison pass.

Keep the security boundary clear

A checksum sent through the same compromised channel as a changed file is not independent proof of authenticity. Verify the reference through a trusted route where needed. Reapprove genuine revisions and generate a new reference. No automatic DistroBolt checksum verification, rights certification or client-file processing is activated here.

Sources and review

Reviewed 4 November 2026. Platform requirements and plan terms can change. Examples are planning aids, not a promise of account access, release acceptance or earnings.

• NIST Secure Hash Standard
• Apache practical file verification

Continue your release planning

• Gapless albums: prepare transitions and separate tracks
• Name audio versions so your team selects the correct master

Ask the DistroBolt team about your release. Send a concise question and release reference; never send account passwords or verification codes.