Skip to main content

Fingerprints and Provenance

What this concept is​

A content digest is a compact value computed from bytes. Provenance records where an input came from and which transformation produced an output. A digest helps compare content, but it does not explain origin, quality or who created a file.

Why it matters here​

When a report changes, you need to ask whether the input, the program or the configuration changed. Keeping these separate is an early form of reproducible engineering.

Concrete example​

Hash the bytes of abc with SHA-256; the expected hexadecimal digest is ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad. Adding a newline changes the bytes and the digest. Two CSV files may represent the same records but differ in line endings, so the lab fingerprints the raw input, not a normalized summary.

A useful run record names the input digest, command, Python version, code revision or saved source snapshot, and result. A digest downloaded beside a file from the same untrusted location does not independently establish that the file is authentic.

Common confusion / misconception​

Hashing is not encryption and does not make sensitive data safe to publish. Equal digests are strong practical evidence of equal content for this lab, not a mathematical proof that collisions cannot exist. A valid digest does not make invalid CSV valid.

How to use it​

Compute the digest after bounded input validation or on the exact raw bytes retained for the accepted input. Preserve the command and the actual result. Do not label a planned run as completed. If you modify the input, keep a distinct name and record why; do not overwrite your only copy of a failure.

Check yourself​

If two reports differ but their input digest matches, what else should you inspect? Program version, configuration and nondeterministic behavior. The digest narrows the question; it does not diagnose the cause.

Mini drill or application​

Run the same fixture twice, then a copy with one changed duration. Compare input digests and results. Explain why a formatting-only change could alter the digest without changing the semantic report.

Read this only if stuck​

Python hashlib documents the digest interface. Cryptographic proofs, signatures and supply-chain verification belong in later coursework.