Verifying platform binaries before you deploy them

The task shape

"An attacker may have replaced a binary. Verify that /usr/local/bin/kubectl
matches the official checksum for v1.35.0."

# 1. fetch the published checksum for that exact version
curl -LO https://dl.k8s.io/v1.35.0/bin/linux/amd64/kubectl.sha256

# 2. check the local file against it
echo "$(cat kubectl.sha256)  /usr/local/bin/kubectl" | sha256sum --check
# /usr/local/bin/kubectl: OK

A tampered binary prints FAILED and 1 computed checksum did NOT match — that
is the answer to write down if the task asks which binary is bad.

Loop over several files:

cd /tmp/verify
for f in kubeadm kubelet kubectl; do
  curl -sLO https://dl.k8s.io/v1.35.0/bin/linux/amd64/$f.sha256
  echo "$(cat $f.sha256)  /usr/bin/$f" | sha256sum --check
done

GPG, for packages

curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.35/deb/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes.gpg
apt-get download kubeadm
dpkg-sig --verify kubeadm_*.deb      # or: apt-get install --print-uris -o Debug::pkgAcquire::Auth=1

RPM world: rpm --checksig package.rpm, dnf repoquery --qf '%{SIGPGP:pgpsig}'.

Images: cosign

cosign verify --key cosign.pub registry.example.com/app:1.4.2
cosign verify-attestation --type spdxjson --key cosign.pub registry.example.com/app:1.4.2

cosign verify exits non-zero and prints Error: no matching signatures for an
unsigned or tampered image — that is what the exam wants you to report or to
enforce (see the supply chain lessons for turning it into an admission rule).

What actually gets marked

The verification command you ran, and that the good binary says OK while the bad one says FAILED.
If the task says "write the result to /root/verify.txt", write the exact OK/FAILED lines — a marker script reads the file, not your memory.
Never "verify" by comparing file sizes or eyeballing. Checksums only.
Downloading the checksum from dl.k8s.io is allow-listed behaviour; pulling a random blog is not the point.