Guide

Check your starter download

Reviewed 15th October 2026.

Each ZIP is built from the source files with a fixed file order, timestamp and permissions. The adjacent manifest lists every file’s relative path, byte size and SHA-256. ZIPs include hidden guidance folders.

Codex pack ZIP · Browse guide · File manifest
Cursor pack ZIP · Browse guide · File manifest
Worked exercise ZIP · Browse guide · File manifest

Verify a download

Save SHA256SUMS, the ZIP and its manifest in the same directory. For the Codex pack on Linux, compare these locally computed hashes with the two matching lines in SHA256SUMS:

sha256sum codex-hour-starter.zip codex-hour-starter-manifest.json

On macOS use shasum -a 256 in place of sha256sum. On Windows PowerShell use:

Get-FileHash .\codex-hour-starter.zip -Algorithm SHA256
Get-FileHash .\codex-hour-starter-manifest.json -Algorithm SHA256

Use the corresponding names for Cursor or the exercise. If either hash differs, stop and download again from the intended source. These hashes check that files agree with the published checksum list. They are not signatures: a compromised download source could replace the ZIP, manifest and list together.

Check individual files

After extraction, paths in the manifest are relative to the folder named by its root field, such as codex-hour/. Hash any file you want to check and compare its size and SHA-256 with that entry. Include hidden folders when comparing the complete file list; an extra or missing file means it is not the same package.

Rebuild from the repository

From a repository checkout with Python 3, run the standard-library builder. It needs no npm package, external service or credentials.

python3 scripts/build_downloads.py

The output goes to docs/packs/. ZIP entries use 1st January 1980, regular-file mode 0644, sorted paths and no compression. Source modification times, permissions and creation order do not affect the bytes. Manifests sit outside the ZIP; SHA256SUMS covers ZIPs and manifests and never hashes itself. No generated timestamp or build counter is added.

npm test runs the normal sync and verifies source/browse/archive parity, manifest hashes, extracted execution and reproducibility after changing source times, modes and creation order. Checksums describe the files in this candidate, not the date of a historical site snapshot.

Run the worked example · First-hour setup · Report a download problem

(Briar helped draft this)