Error code: Wsl/InstallDistro/VerifyChecksum/TRUST_E_BAD_DIGEST sporadically when running on github actions

[danielmarbach]

Windows Version

Microsoft Windows Server 2025 10.0.26100 DataCenter

WSL Version

2.7.11.0

Are you using WSL 1 or WSL 2?

• WSL 2
• WSL 1

Kernel Version

No response

Distro Version

No response

Other Software

Current runner version: '2.336.0'
Runner Image Provisioner
Hosted Compute Agent
Version: 20260707.563
Commit: 02667638d2b423fbc733a8e32a88b44996a3ba6e
Build Date: 2026-07-07T19:33:50Z
Worker ID: cf7f55e3-59f2-44fc-9ade-267a6f1631a9
Azure Region: northcentralus
Operating System
Microsoft Windows Server 2025
10.0.26100
Datacenter
Runner Image
Image: windows-2025-vs2026
Version: 20260728.188.1
Included Software: https://github.com/actions/runner-images/blob/win25-vs2026/20260728.188/images/windows/Windows2025-VS2026-Readme.md
Image Release: https://github.com/actions/runner-images/releases/tag/win25-vs2026%2F20260728.188

Repro Steps

https://github.com/Particular/install-sql-server-action/blob/main/setup.ps1#L266-L295

Expected Behavior

Download should succeed

Actual Behavior

Installing Debian in WSL
Downloading: Debian GNU/Linux

Installing: Debian GNU/Linux

The distribution hash doesn't match. Expected: 5ec7dc68216e75d1d4d4761474e99d8461a98d316537110314b137122a879e0f, actual hash: 0xc2a695720163a82d32dd14449f521f6e8f80cb5a9df1a792716cf37aea801401

Error code: Wsl/InstallDistro/VerifyChecksum/TRUST_E_BAD_DIGEST

Diagnostic Logs

No response

[github-actions]

Logs are required for review from WSL team

If this a feature request, please reply with '/feature'. If this is a question, reply with '/question'.
Otherwise, please attach logs by following the instructions below, your issue will not be reviewed unless they are added. These logs will help us understand what is going on in your machine.

How to collect WSL logs

Download and execute collect-wsl-logs.ps1 in an administrative powershell prompt:

Invoke-WebRequest -UseBasicParsing "https://raw.githubusercontent.com/microsoft/WSL/master/diagnostics/collect-wsl-logs.ps1" -OutFile collect-wsl-logs.ps1
Set-ExecutionPolicy Bypass -Scope Process -Force
.\collect-wsl-logs.ps1

The script will output the path of the log file once done.

If this is a networking issue, please use .\collect-wsl-logs.ps1 -LogProfile networking instead, following the instructions in Collect WSL logs for networking issues

Once completed please upload the output files to this GitHub issue.

See Collect WSL logs (recommended method).

If you choose to email these logs instead of attaching them to the bug, please send them to wsl-gh-logs@microsoft.com with the GitHub issue number in the subject, and include a link to your GitHub issue comment in the message body, and reply with '/emailed-logs'.

[danielmarbach]

Trying to remove the web download now to see if that fixes it

[danielmarbach]

It did not fix it

[chemwolf6922]

Hi Daniel Marbach (@danielmarbach) .
There seems to be a problem with the upstream debian server hosting the artifact. Directly downloading it is reporting code 503.
I'll try to reach the debian maintainers to report this.

[danielmarbach]

Feng Wang (@chemwolf6922) Yeah, exactly, because switching to Ubuntu as a default made it work.