To valiate integrity or To verify if the software is digitally signed
The question seems wrong to me. I do not see any reason to publish(make public) a hash. But it is in the material I am studying.
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.Sign up to join this community
Hashes are routinely made public. Either of the given reasons can be correct depending on the exact scenario. Here I assume a cryptographically secure unkeyed hash (so it has preimage resistance, second preimage resistance and collision resistance).
A one way hash can be used to validate integrity (if a file is changed a well designed hash (say SHA2) of the file will change, and typically it will change in approximately half of its bit values--this is called the avalanche effect).
Hashes are also used for digital signatures, since one can digitally sign the hash (which is fixed length) of the file instead of the file itself.
For a different example, in login servers there usually is a public file of usernames and hashes of passwords. This enables remote login where the client machine applies the (unkeyed) hash to the input password and this is compared to the hash stored in the public file.
Hashes can be made public to verify the integrity of the data or verify that a program or file was made by the valid author. You see integrity checks on programs with MD5 or SHA- hashes. If a bit flips or many bytes are corrupted when you download or write the program onto your computer, the hash will change dramatically. This is known as the Avalanche Effect in cryptography.
When you see a programmer or an author of a Email or text file "digitally sign" the file, this is usually done with versions of RSA and it is the modern base for verifying the sender of an Email. Outside the Email World, you will see this used for privacy-centric programs like Tor Browser, Monero GUI and CLI and others as the userbase of those programs are concerned about malicious actors masquerading as the original authors.
It is a very useful tool to validate that what the person sending it to you was messaging you what they wanted. You know that what you got was both sent by the actual person and is the data in the purest form.*
Common Scenario: I do it all the time with Ansible.
PS. Some certification DUMP SITES mark incorrect answers as correct. I know the exact question you are referring to ;)