# Updating Checksums

> Syncs SHA-256 checksums from GitHub releases to bundle-tools.json. Triggers when user mentions "update checksums", "sync checksums", or after releasing new tool versions.

- Skill: `socketdev/updating-checksums` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add socketdev/updating-checksums`
- Raw SKILL.md: https://api.skillmd.com/api/skills/socketdev/updating-checksums/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: socketdev (https://skillmd.com/u/socketdev)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/socketdev/updating-checksums

---


# updating-checksums

<task>
Your task is to sync SHA-256 checksums from GitHub releases to the embedded `bundle-tools.json` file, ensuring SEA builds have up-to-date integrity verification.
</task>

<constraints>
- Network access required to fetch from GitHub API.
- Only `github-release` type tools are synced (not npm or pypi).
- Never modify checksums manually; always fetch from releases.
- Verify JSON validity after sync.
- Review changes before committing.
</constraints>

## Phases

1. **Check Current State** - Review current checksums and tool versions in `packages/cli/bundle-tools.json`.
2. **Sync Checksums** - Run `node packages/cli/scripts/sync-checksums.mjs`. Tries `checksums.txt` from the release first; falls back to downloading assets and computing SHA-256.
3. **Verify Changes** - `git diff packages/cli/bundle-tools.json`; validate JSON syntax.
4. **Commit Changes** - If updated, commit `packages/cli/bundle-tools.json`.

## Commands

```bash
node packages/cli/scripts/sync-checksums.mjs              # Sync all
node packages/cli/scripts/sync-checksums.mjs --tool=opengrep  # Sync one
node packages/cli/scripts/sync-checksums.mjs --dry-run     # Preview
node packages/cli/scripts/sync-checksums.mjs --force       # Force update
```