As I read in the documentation and was able to find out myself, rclone verifies the file transfer when sending and retrieving files if the remote peer supports hashing.
For example, when I upload a file to my Minio instance, rclone uses md5 hashing (if not disabled).
However, when I want to retrieve the sha256 of a file stored in my Minio instance, the data retrieval does not seem to be checked. At least I could not see any logs when I run something like:
minio support MD5 based hashes natively. So that is what rclone uses for file integrity checks. Rclone does not support SHA256 hashes when used with S3 (I'm not 100% sure if you can use sha256 hashes with s3). So your rclone hashsum sha256 --download command will stream the file from the remote and report the sha256 hash. That is a great way of double checking file integrity as you actually fetch it.
So your rclone hashsum sha256 --download command will stream the file from the remote and report the sha256 hash.
Yes, and that is my question / ("concern"). If I'm not mistaken this streaming process isn't checked / protected by using a already known hashsum which the remote supports. Yes, I know you could call me kind of persimistic or paranoid but the download is checked/verified atleast if a supported hashsum exists.
That is a great way of double checking file integrity as you actually fetch it.
But that just works if I know the sha256 before retrieving the data.