Which of the following is the BEST way to verify the integrity of a software patch?

Cryptographic checksums (such as MD5, SHA-256, or SHA-512 hashes) generate a unique fixed-length digest of a file's contents; if even a single bit is altered, the hash value changes completely. By comparing the hash published by the vendor against the hash computed locally on the downloaded patch, an administrator can definitively confirm the file's integrity and authenticity. This method is a foundational cryptographic control used across the industry for software distribution validation.

Version numbering only identifies which release of software a patch represents and provides no cryptographic proof that the file contents are unaltered or authentic.

Automatic updates streamline the delivery mechanism but do not themselves verify the integrity of the patch payload; they rely on underlying signing or hash mechanisms to do so.

Vendor assurance is a trust-based, non-technical control that offers no mathematical or cryptographic guarantee that a specific downloaded file has not been modified or corrupted.