Checksum has changed for IIS-ARR package

[andmos]

Just installing this today as a part of our server provisioning:

File appears to be downloaded already. Verifying with package checksum to determine if it needs to be redownloaded.
Error - hashes do not match. Actual value was '9BBE610E347909AFA68230778B9242BB57BBBC55'.
Downloading iis-arr 64 bit
  from 'https://download.microsoft.com/download/E/9/8/E9849D6A-020E-47E4-9FD0-A023E99B54EB/requestRouter_amd64.msi'
Progress: 100% - Completed download of C:\temp\chocolatey\iis-arr\3.0.20160107\requestRouter_amd64.msi (2.11 MB).
Download of requestRouter_amd64.msi (2.11 MB) completed.
Error - hashes do not match. Actual value was '9BBE610E347909AFA68230778B9242BB57BBBC55'.
ERROR: Checksum for 'C:\temp\chocolatey\iis-arr\3.0.20160107\requestRouter_amd64.msi' did not meet '5f4f24058dcd675da46d
c0c4b17969d41fce68c1' for checksum type 'sha1'. Consider passing the actual checksums through with --checksum --checksum
64 once you validate the checksums are appropriate. A less secure option is to pass --ignore-checksums if necessary.

I guess a new version of the MSI is available, so det checksum needs to be updated. Thanks!

[bcc]

Hmm, you're quite right - I see the same checksum on a download, but the WebPI XML doc still has the old checksums listed, which is a concern. X86 is the same too. Looks like they were both recreated on December 2nd, but I'm not sure what the difference is - there's no obvious version bump. I'll see if I can get this change confirmed as being legitimate.

[andmos]

That would be great, not a fan of running with --ignore-checksums when we roll out packages that just point to some MSI's on the big scary internet ;) Thanks in advance!

[bcc]

Indeed. It does have a valid code signature which is a good sign at least. There’s no detail on any of the download pages and they still reference the old version number so I’ll hold off on pushing out a new one until tomorrow just in case.

[bcc]

MS have removed the old webpi XML, but fixed the standalone installer. Given the code signatures are valid, I've pushed a new version of the package, which is currently pending approval from the moderators. Hopefully won't be too long until it's live.

[andmos]

Brilliant. Guess it comes in soon then.

[bcc]

The updated package has just been approved by the moderators.