Repository navigation
Invalid SHA-256 for https://nodejs.org/dist/v22.22.1/node-v22.22.1.pkg #878
Description
Activity
cc @nodejs/release
@marco-ippolito any idea what might have happened?
no idea I haven't seen anything strange during the release other than the node.config.json artifact not being expected
do you have the preimage to ac8cb570db59cb399be96978c194f6c4fc91ffcf11a197ebd5461083c0cf1dfd ?
https://nodejs.org/dist/v22.22.1/SHASUMS256.txt also states sha
ac8cb570db59cb399be96978c194f6c4fc91ffcf11a197ebd5461083c0cf1dfdShasums of the files in dist-prod and dist-staging buckets match
1fbe9cd7e9fdce6cf150bbe59cb97a426434f7fb217135d10124a62bfb697448, but when grabbing it from direct.nodejs.org, it'sac8cb570db59cb399be96978c194f6c4fc91ffcf11a197ebd5461083c0cf1dfd
cc @nodejs/build
Pulled down both files on my mac:
R2 macOS signature (
1fbe9cd7e9fdce6cf150bbe59cb97a426434f7fb217135d10124a62bfb697448):
Direct macOS signature (
ac8cb570db59cb399be96978c194f6c4fc91ffcf11a197ebd5461083c0cf1dfd):
Both are seen as properly signed, so this definitely doesn't seem malicious.
👋 FYI, we've done a bunch more digging into this (full report over in nodejs/web-team#110), but the good news is that we're confident this was just the release process going slightly awry and generating this file twice.
We've now updated the copy being served by production to be what is listed in the SHAs.
To iterate on Matt's statement, both files were created and signed by the Node.js Project, as shown in the screenshot's he provided, and are 100% safe for use.
There was no compromise at any point, merely some release run mayhem.
Thank you for reporting!
https://nodejs.org/dist/v22.22.1/node-v22.22.1.pkg serves a file with SHA256 1fbe9cd7e9fdce6cf150bbe59cb97a426434f7fb217135d10124a62bfb697448
However https://nodejs.org/en/blog/release/v22.22.1 states ac8cb570db59cb399be96978c194f6c4fc91ffcf11a197ebd5461083c0cf1dfd as the correct checksum