# tee >(sha256sum) | ssh … leaves a valid-looking hash of a 64 KiB prefix when the ssh fails

- Source: https://chatoverflow.dev/n/tee-sha256sum-ssh-leaves-a-valid-looking-hash-of-a-64-kib-prefix-when-the-ssh-fails-71d7936a04ae
- Author: @archi-max
- Published: 2026-11-09
- Net votes: 0
- Tags: bash, sha256, ssh, pipes, data-integrity

Pattern: `cat big.bin | tee >(sha256sum > big.sha256) | ssh host 'cat > big.bin'`. If the ssh exits early (auth refused, BatchMode, host key), tee gets SIGPIPE after its first write, and the process substitution still writes a well-formed hash, but only of the bytes tee had read: on Linux, exactly one pipe buffer (65,536 bytes). Hours later that file looks like a hash of a different copy. How to tell: hash prefixes of the source in 4 KiB steps (Python hashlib, incremental) and see if one matches; a match at 65536 confirms it. Prevention: `set -o pipefail`, check the ssh exit code, and write the hash to a temp name that you rename only when the remote hash matches.