This message was deleted.

sparse-intern-71089

02/28/2022, 10:22 AM

This message was deleted.

echoing-dinner-19531

02/28/2022, 10:28 AM

Odd, checks out ok to me and matches what our release job printed:

Copy code

sha256sum pulumi-v3.25.0-linux-x64.tar.gz
7c283885947a563fd956d6b6146aa0ab243569dae20a912328afc3b7ca568596  pulumi-v3.25.0-linux-x64.tar.gz

https://github.com/pulumi/pulumi/runs/5312955548?check_suite_focus=true:

Copy code

7c283885947a563fd956d6b6146aa0ab243569dae20a912328afc3b7ca568596  pulumi-v3.25.0-linux-x64.tar.gz

adorable-gpu-98268

02/28/2022, 10:29 AM

This is what I get:

Copy code

~ % sha256sum pulumi-v3.25.0-linux-x64.tar.gz 
fded5fbde6f9f6eec598ce17b047d96536824dfc4dbba2028f48eba36a1a78f0  pulumi-v3.25.0-linux-x64.tar.gz

echoing-dinner-19531

02/28/2022, 10:32 AM

Interesting, let me test another machine

echoing-dinner-19531

02/28/2022, 10:35 AM

Can you raise an issue on our github about this, it all seems ok to my machines but maybe there's some location variation on how this is downloaded.

adorable-gpu-98268

02/28/2022, 10:35 AM

That’s the file that

curl -O "<https://get.pulumi.com/releases/sdk/pulumi-v3.25.0-linux-x64.tar.gz>"

downloads for me:

pulumi-v3.25.0-linux-x64.tar.gz

echoing-dinner-19531

02/28/2022, 10:38 AM

Yeh I'm not equipped to try and decipher potentially compromised files. Please raise an issue.

adorable-gpu-98268

02/28/2022, 10:49 AM

I’ll link to this thread here with the file in the github issue

adorable-gpu-98268

02/28/2022, 10:50 AM

https://github.com/pulumi/pulumi/issues/9063

echoing-dinner-19531

02/28/2022, 11:03 AM

Thanks, some more digging that checksum matches whats on github releases. Not sure how we've ended up with different files on releases vs get.pulumi.com

echoing-dinner-19531

02/28/2022, 11:03 AM

I'll post any further updates on the github issue.

adorable-gpu-98268

02/28/2022, 11:04 AM

Thanks, that looks like a good lead!

adorable-gpu-98268

02/28/2022, 11:05 AM

Strange thing is: I get different files based on downloading with

culr/wget

Safari

from this same url. The cmd tools give me the file that doesn’t match and the Safari download gives me the file that matches.

adorable-gpu-98268

03/01/2022, 8:01 AM

Any updates on this? I use the checksum to lock the pulumi version used in a build, so to upgrade to 3.25.0 I’d like to have checksums that match the binary.

echoing-dinner-19531

03/01/2022, 9:03 AM

Sorry, the release went out twice but it looks like between the first binaries being pushed and then the seconds ones being pushed and overwriting them someone hit the download link and populated the cloudfront cache in one location. I don't have write access to that aws account and I guess our ops team (in America) missed the thread yesterday, I'll give them a nudge and try to get that done this evening. You could download from github releases instead of get.pulumi.com for now if you need the checksums to match.

adorable-gpu-98268

03/01/2022, 9:11 AM

Thanks 👍 I’ll wait with the update until this is fixed.

miniature-musician-31262

03/01/2022, 7:19 PM

Hi there. We’ve cleared the cache on both

/releases/sdk/pulumi-3.25*

and

/releases/sdk/pulumi-v3.25.*

, so I believe this is fixed. Let us know if you’re still seeing otherwise, though.

Open in Slack

Previous Next

Pulumi Community

No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.