Hi it seems to me the checksums for pulumi 3 25 0 for linux

Question

Hi it seems to me the checksums for pulumi 3 25 0 for linux x64 do not match the file ```curl O curl O sha256sum c pulumi 3 25 0 checksums txt``` returns ``` sha256sum WARNING 1 computed checksum did NOT match```

echoing-dinner-19531 · Answer

Odd checks out ok to me and matches what our release job printed ```sha256sum pulumi v3 25 0 linux x64 tar gz 7c283885947a563fd956d6b6146aa0ab243569dae20a912328afc3b7ca568596 pulumi v3 25 0 linux x64 tar gz``` <https github com pulumi pulumi runs 5312955548 check suite focus=true> ```7c283885947a563fd956d6b6146aa0ab243569dae20a912328afc3b7ca568596 pulumi v3 25 0 linux x64 tar gz```

adorable-gpu-98268 · Answer

This is what I get ```~ sha256sum pulumi v3 25 0 linux x64 tar gz fded5fbde6f9f6eec598ce17b047d96536824dfc4dbba2028f48eba36a1a78f0 pulumi v3 25 0 linux x64 tar gz```

echoing-dinner-19531 · Answer

Interesting let me test another machine

echoing-dinner-19531 · Answer

Can you raise an issue on our github about this it all seems ok to my machines but maybe there s some location variation on how this is downloaded

adorable-gpu-98268 · Answer

That s the file that `curl O <https get pulumi com releases sdk pulumi v3 25 0 linux x64 tar gz> ` downloads for me

echoing-dinner-19531 · Answer

Yeh I m not equipped to try and decipher potentially compromised files Please raise an issue

adorable-gpu-98268 · Answer

I ll link to this thread here with the file in the github issue

adorable-gpu-98268 · Answer

echoing-dinner-19531 · Answer

Thanks some more digging that checksum matches whats on github releases Not sure how we ve ended up with different files on releases vs <http get pulumi com|get pulumi com>

echoing-dinner-19531 · Answer

I ll post any further updates on the github issue

adorable-gpu-98268 · Answer

Thanks that looks like a good lead

adorable-gpu-98268 · Answer

Strange thing is I get different files based on downloading with `culr wget` or `Safari` from this same url The cmd tools give me the file that doesn t match and the Safari download gives me the file that matches

adorable-gpu-98268 · Answer

Any updates on this I use the checksum to lock the pulumi version used in a build so to upgrade to 3 25 0 I d like to have checksums that match the binary

echoing-dinner-19531 · Answer

Sorry the release went out twice but it looks like between the first binaries being pushed and then the seconds ones being pushed and overwriting them someone hit the download link and populated the cloudfront cache in one location I don t have write access to that aws account and I guess our ops team in America missed the thread yesterday I ll give them a nudge and try to get that done this evening You could download from github releases instead of <http get pulumi com|get pulumi com> for now if you need the checksums to match

adorable-gpu-98268 · Answer

Thanks thumbsup I ll wait with the update until this is fixed

miniature-musician-31262 · Answer

Hi there We ve cleared the cache on both ` releases sdk pulumi 3 25 ` and ` releases sdk pulumi v3 25 ` so I believe this is fixed Let us know if you re still seeing otherwise though