Ubuntu – wget works one server for a url but gets 403 forbidden on another

So you want to download and run http://example.com/install.sh.

For now I assume that you have its SHA256 hash stored locally in a file called my-sha256.txt. The file contains only the hash itself and a Unix-style linebreak character, so its size must be exactly 65 bytes. You can create it by simply running this:

sha256sum ORIGINAL_FILE.SH | grep -Eo '^\w+' > my-sha256.txt

How you distribute this hash file from your development machine to the client is not part of this answer (yet, you might clarify your question and ask me to update this part based on your detailed specifications).

The actual command your client has to run to download, verify, and on success execute the script could look like this:

t=$(mktemp) && wget 'http://example.com/install.sh' -qO "$t" && if sha256sum "$t" | grep -Eo '^\w+' | cmp -s my-sha256.txt ; then bash "$t" ; else echo FAIL ; fi ; rm "$t"

Slightly shortened and ugly version without whitespace:

t=$(mktemp)&&wget 'http://example.com/install.sh' -qO"$t"&&if sha256sum "$t"|grep -Eo '^\w+'|cmp -s my-sha256.txt;then bash "$t";else echo FAIL;fi;rm "$t"

Placed on multiple lines for readability:

t=$(mktemp) && 
wget 'http://example.com/install.sh' -qO "$t" && 
if sha256sum "$t" | grep -Eo '^\w+' | cmp -s my-sha256.txt 
    then bash "$t" 
    else echo FAIL 
fi 
rm "$t"

If you want to directly provide the hash inside the command as string instead of reading from a file, simply use one of my original command versions above and replace the occurrence of my-sha256.txt with <(echo YOUR_HASH), inserting your real hash instead of the "YOUR_HASH" placeholder of course.

Explanation:

The script/one-liner first creates a temporary file using mktemp (uses the system's temp folder /tmp).
Then it uses wget to download your installation script from the specified URL and save it in the temp file.
Now we calculate its hash sum, filter only the hash value from the output of sha256sum and compare that to what we have stored in out my-sha256.txt.
If both hashes equal, we will invoke bash with our temporary script file as argument, else we echo FAIL or you could output a custom error message.
In the end we clean up by deleting our temporary file in both cases.

However, coming back to the problem of securely distributing the hash to verify the original script, this solution above will not help you much, as it solves one problem by creating another one of the same kind.

What you actually should do is to create a GPG key pair (and publish your public key to a keyserver), sign your script with it and offer the compressed signed binary for download. Then let the client verify and decrypt the script using gpg again and run it on success.

Google Chrome as well as Mozilla Firerfox both provide an option to copy download link specifically for cURL. This option will generate cURL with all required things such as User agent for downloading things from the side. To get that,

1. Open the URL in either of the browser.
2. Open Developer options using Ctrl+Shift+I.
3. Go to Network tab.
4. Now click on download. Saving file isn't required. We only need the network activity while browser requests the file from the server.
5. A new entry will appear which would look like "download.aspx?...".
6. Right click on that and Copy → Copy as cURL.
7. Paste the copied content directly in the terminal and append --output file.extension to save the content in file.extension since terminal isn't capable of showing binary data.

An example of the command:

curl 'https://company-my.sharepoint.com/personal/path/_layouts/15/download.aspx?SourceUrl=
%2Fpersonal%2Fsome%5Fpath%5Fin%2Ffile' -H 'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux 
x86_64; rv:73.0) Gecko/20100101 Firefox/73.0' -H 'Accept: text/html,application/xhtml+xml,
application/xml;q=0.9,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' 
--compressed -H 'DNT: 1' -H 'Connection: keep-alive' -H 'Referer: https://company-my
.sharepoint.com/personal/path/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fagain%5Fa%5Fpath%2F
file&parent=%2Fpersonal%2Fpath%5Fagain%5Fin%2&originalPath=somegibberishpath' -H 
'Cookie: MicrosoftApplicationsTelemetryDeviceId=someid; 
MicrosoftApplicationsTelemetryFirstLaunchTime=somevalue; 
rtFa=rootFederationAuthenticationCookie; FedAuth=againACookie; CCSInfo=gibberishText; 
FeatureOverrides_enableFeatures=; FeatureOverrides_disableFeatures=' -H 
'Upgrade-Insecure-Requests: 1' -H 'If-None-Match: "{some value},2"' -H 'TE: Trailers' 
--output file.extension

Further Reading: why would curl and wget result in a 403 forbidden?