Verify hashes in the release manifests

[nagilson]

dotnetup has failed in CI several times due to an invalid hash in the release, so let's check the hashes to help the release team see which releases need validation/changes.

Throw away script and CI change.

Results:

7.0 archives

  File:     aspnetcore-runtime-osx-x64.tar.gz
  URL:      https://builds.dotnet.microsoft.com/dotnet/aspnetcore/Runtime/7.0.20/aspnetcore-runtime-7.0.20-osx-x64.tar.gz
  RID:      osx-x64
  Component:aspnetcore-runtime
  Expected: 00677819450d14d9adc2b65f25b9a069bc2b43f72e4db651e77fe0e48320be8eb7c555277281de968e75d0fb19bef960d4dcb27161b8c57bce076ee18bb5ca98
  Actual:   23407dd0327c863e49628fc4539e0cde775a9e76fb9c6a88d13de8e7b774115f3bd56a145937b4e3b4ff40e8b03422263f0eb2be8ad194410d652c5e44374cb4
  Kept at:  D:\a\_work\1\s\src\Installer\releases\7.0\7.0.20_aspnetcore-runtime_osx-x64_aspnetcore-runtime-osx-x64.tar.gz

  Release:  7.0.12
  File:     aspnetcore-runtime-osx-arm64.tar.gz
  URL:      https://builds.dotnet.microsoft.com/dotnet/aspnetcore/Runtime/7.0.12/aspnetcore-runtime-7.0.12-osx-arm64.tar.gz
  RID:      osx-arm64
  Component:aspnetcore-runtime
  Expected: f64e91e968858ec60219761635d2b4062926dc7050c206619a972244c5fb8ae016ec1b48e0a29e61b13e61ccaf7ef1ee27ef7ed4ba96b771a42d43f32b6965ae
  Actual:   91e68b16d7d285cf910e62cbe5978e767fe4933d420971c57c17805cf9a34ca1add43e9501024bfb40e80ea1dad34e2a6302e2c559d7a88995e633b4d9ea0bfa
  Kept at:  D:\a\_work\1\s\src\Installer\releases\7.0\7.0.12_aspnetcore-runtime_osx-arm64_aspnetcore-runtime-osx-arm64.tar.gz

  Release:  7.0.12
  File:     aspnetcore-runtime-osx-x64.tar.gz
  URL:      https://builds.dotnet.microsoft.com/dotnet/aspnetcore/Runtime/7.0.12/aspnetcore-runtime-7.0.12-osx-x64.tar.gz
  RID:      osx-x64
  Component:aspnetcore-runtime
  Expected: ae1e0adddbd6afea3a0f6974433021e3b49e32ad1c56900b1cfde8f656fb645b3ab966cf42ce95b1829fac05e9556cfd4ad1cadb5dc5d1925c157b54fe8c5b95
  Actual:   ea394e7610eae30ad362804cee401a8c83e2ef54eab75799e972bb8b2ad66881493383c464f1e2dd88ff6787edc3237c565eb24e2f52043698a5f40c6a2c3691
  Kept at:  D:\a\_work\1\s\src\Installer\releases\7.0\7.0.12_aspnetcore-runtime_osx-x64_aspnetcore-runtime-osx-x64.tar.gz

6.0 archives

============================================
  VERIFICATION RESULTS FOR 6.0
============================================
  Total files checked: 2597
  Valid (hash match):  2553
  MISMATCHED:          44
  Failed/Error:        0

MISMATCHED FILES (kept for inspection):
----------------------------------------
  Release:  6.0.2
  File:     dotnet-runtime-osx-arm64.tar.gz
  URL:      https://builds.dotnet.microsoft.com/dotnet/Runtime/6.0.2/dotnet-runtime-6.0.2-osx-arm64.tar.gz
  RID:      osx-arm64
  Component:runtime
  Expected: baca2588b25cddaee87e45fd347c5e305dc68604045827213db18221e20f545d81824f411502ce29c93e59094e0f18d66eaa6212c4dd2a1b696ace543adcc0d2
  Actual:   07c0df0c86fa43d45267d6d6d7a82b24d7c2f951ffbb2f18e5b020d834c97017c80913590ce8116261d250041dd118a9cdef7e57de12ba792ad5b1ace5a60e0f
  Kept at:  D:\a\_work\1\s\src\Installer\releases\6.0\6.0.2_runtime_osx-arm64_dotnet-runtime-osx-arm64.tar.gz

  Release:  6.0.2

[nagilson]

/azp run

[azure-pipelines]

Azure Pipelines failed to run 1 pipeline(s).

[Copilot]

Pull request overview

Adds a PowerShell-based verification step intended to catch invalid SHA-512 hashes in .NET release manifests earlier (before they break dotnetup CI), and wires this verification into the dnup PR pipeline.

Changes:

• Added Verify-ReleaseHashes.ps1 to download release assets referenced by releases.json and verify their SHA-512 hashes.
• Updated .vsts-dnup-pr.yml to run hash verification for channels 7.0–10.0 and to add an executables build stage.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

File	Description
src/Installer/releases/Verify-ReleaseHashes.ps1	New script to fetch a channel’s releases.json, download .zip/.tar.gz assets, compute SHA-512, and report mismatches.
.vsts-dnup-pr.yml	Adds stages/jobs to build dotnetup executables and to run/publish hash verification results for multiple channels.

Comments suppressed due to low confidence (1)

.vsts-dnup-pr.yml:11

• The PR branch include list adds a specific topic branch name (nagilson-dnup-executables). If this branch is not intended to be a long-lived target branch, keeping it here will cause unexpected PR validation behavior and future maintenance churn. Consider removing it before merging unless it’s meant to be a permanent branch pattern.

    - dnup
    - release/dnup
    - release/dotnetup

[nagilson]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).