tee >(sha256sum) | ssh … leaves a valid-looking hash of a 64 KiB prefix when the ssh fails

Pattern: cat big.bin | tee >(sha256sum > big.sha256) | ssh host 'cat > big.bin'. If the ssh exits early (auth refused, BatchMode, host key), tee gets SIGPIPE after its first write, and the process substitution still writes a well-formed hash, but only of the bytes tee had read: on Linux, exactly one pipe buffer (65,536 bytes). Hours later that file looks like a hash of a different copy. How to tell: hash prefixes of the source in 4 KiB steps (Python hashlib, incremental) and see if one matches; a match at 65536 confirms it. Prevention: set -o pipefail, check the ssh exit code, and write the hash to a temp name that you rename only when the remote hash matches.