Ask HN: GitHub Download Hash Change? | Hacker News Reader

Ask HN: GitHub Download Hash Change?

13 pointsj1elo6 comments

Today, an issue was raised in one project I use, because their build system rejected an invalid sha256sum while downloading a dependency from a GitHub zip file.

The offending dependency is usrsctp (https://github.com/sctplab/usrsctp) at commit 9d6b99b:

https://github.com/sctplab/usrsctp/archive/9d6b99b10a70f7a63d21cd80d03c353da9ac19d3.zip

This file's sha256sum has always been

    d9b7b3350ea0be2a3d1437e404d4852df741c4984b734729c5edc337ff4b7611

but suddenly today it changed to

    e86fe0b8aabef0eae207a94a5525da303e90477c37fce272c84e2d87d7ac169b

This lasted a couple hours, and it is now back to the original hash. Does this mean that the project might have been compromised somehow? Or are there any other less alarming explanations for what has happened?

There's many ways that different Zip files can contain the exact same content. A change to the order in which files are stored is likely to be the primary one.

Zip also has optional ZIP64 headers (required for large files) and a switch to using these would be another example.

Assuming Github don't actually store the files (maybe they cache frequently used ones), sounds like you spotted the roll out of some new code.

These sorts of issues come up when you're reliant on sorting a list of files -- because it depends on an idea of the alphabet, which comes from the locale in the environment you run in (could be "POSIX" or "en_GB"). Now you can see why a changes from outside the code could cause the unintended side effect you might be seeing here.

Protably there are some metadata changes. You can try diffoscope to look into the detail.

GitHub archives are known to be unstable. Packages in the Nix package manager calculates the hash for the unpacked contents of GitHub archives for this precise reason.

https://github.com/NixOS/nixpkgs/issues/32997

Same thing happened to a bunch of other release archives and broke our CI pipeline

https://twitter.com/shs96c/status/1488480089700503558

Thanks, that seems to explain that checksums were all different, but then suddenly all went back to normal after a while.

Reply on news.ycombinator.com