Integrity metadata is information used to verify that a file matches an expected trusted state. A common example is a cryptographic hash: a verifier calculates the file’s hash and compares it with a trusted value. A mismatch can indicate that the file changed, though it does not by itself show who changed it or why.
In software distribution, integrity checks help defenders detect altered installers, updates, or configuration files. The expected value must come from a source attackers cannot also control; otherwise, an attacker who changes a package and its accompanying hash may defeat the check. Independent signatures, protected records of expected values, and endpoint telemetry can strengthen verification. In a supply-chain investigation, comparing files against trustworthy historical integrity metadata may reveal tampering even after a server has been restored.