With the URL and filename substituted, the command you're actually running is this:
diff -is <(echo `curl "$url"`) <(shasum -a 256 "$file")
^ ^
Note that's backticks in echo `curl...` , not single quotes as in your post(*). Passing the output of curl through that unquoted command substitution applies word splitting, giving two distinct arguments to echo, which then joins them with a single space. In effect, changing the double space in the file to a single one.
(* with single quotes, it'd output curl https://..., not run it as a command)
See:
That's also the reason diff gives any output at all: the lines differ in only that one space.
If you drop the useless command substitution and run
diff -is <(curl "$url") <(shasum -a 256 "$file")
instead, it should recognize the files as identical, and with -s, tell you that. Then, you could just use the exit status of diff directly without caring about the printed output:
if diff -iq <(curl "$url") <(shasum -a 256 "$file") > /dev/null; then
echo "hashes are the same"
else
echo "hashes differ"
fi
Though you don't need diff there except for the case-ignoring function, but I don't think that's necessary. You could store the outputs in shell variables and compare them:
their=$(curl "$url")
mine=$(shasum -a 256 "$file")
if [[ "$their" == "$mine" ]]; then
echo "hashes match"
else
echo "hashes do not match"
fi
Or, if you want to compare just the initial part with the hash:
their=$(curl "$url")
their=${their%% *}
mine=$(shasum -a 256 "$file")
mine=${mine%% *}
if [[ "$their" == "$mine" ]]; then
...
Or even something like
read -r hash1 filename1 < <(curl "$url")
etc.
to read both fields from the output to separate variables.