Hashlib: a digest checks content, not identity

Useful to know

hashlib.sha256(b'abc').hexdigest() returns a hexadecimal digest of the supplied bytes. Successive update() calls process chunks of the same stream. [1]

This allows a large file to be read incrementally. A match is useful only when the expected digest comes from a trustworthy context. Recalculating it alone does not stop an attacker who can replace both the file and its published hash.