Rubinius 3.78 checksums appear to be incorrect

[yb66]

Hi,

I was installing Rubinius 3.78 via ruby-install and it said the MD5 checksums didn't match so I then went to the Rubinius downloads page and got the SHA512 but it still failed:

ruby-install -r /opt/rubies --sha512 b704768a9bb1c65040847d8bb967f8fceb80e17397fb0573adeee03aa2b807e2860002b8dcb9f4f0c1af3b63dc91ae1ef414c0e300bd078da535c01928c8a871 rbx
>>> Installing rbx 3.78 into /opt/rubies/rbx-3.78 ...
>>> Downloading https://rubinius-releases-rubinius-com.s3.amazonaws.com/rubinius-3.78.tar.bz2 into /Users/iain/src ...
>>> Verifying rubinius-3.78.tar.bz2 ...
!!! Invalid md5 checksum for /Users/yb/src/rubinius-3.78.tar.bz2
!!!   expected: 7ffacca58136b0e89b942ab5f12442a6
!!!   actual:   91298cd73da8af001692204c410d518b
!!! Verification of rubinius-3.78.tar.bz2 failed!

The hashes I calculated for the tar from Rubinius' github release page are:

$ md5 ~/Downloads/rubinius-3.78.tar.bz2
MD5 (/Users/iain/Downloads/rubinius-3.78.tar.bz2) = 91298cd73da8af001692204c410d518b

$ shasum -a512 ~/Downloads/rubinius-3.78.tar.bz2
b704768a9bb1c65040847d8bb967f8fceb80e17397fb0573adeee03aa2b807e2860002b8dcb9f4f0c1af3b63dc91ae1ef414c0e300bd078da535c01928c8a871  /Users/iain/Downloads/rubinius-3.78.tar.bz2

The SHA512 matches the one from the downloads page.

$ cat ~/Downloads/rubinius-3.78.tar.bz2.sha512
b704768a9bb1c65040847d8bb967f8fceb80e17397fb0573adeee03aa2b807e2860002b8dcb9f4f0c1af3b63dc91ae1ef414c0e300bd078da535c01928c8a871

I also ran those calculations against the tar file that ruby-install downloaded:

$ md5 $HOME/src/rubinius-3.78.tar.bz2
MD5 (/Users/iain/src/rubinius-3.78.tar.bz2) = 91298cd73da8af001692204c410d518b

$ shasum -a512 $HOME/src/rubinius-3.78.tar.bz2 
b704768a9bb1c65040847d8bb967f8fceb80e17397fb0573adeee03aa2b807e2860002b8dcb9f4f0c1af3b63dc91ae1ef414c0e300bd078da535c01928c8a871  /Users/iain/src/rubinius-3.78.tar.bz2

However, the hashes in this repository are different in both cases:

MD5
7ffacca58136b0e89b942ab5f12442a6

SHA512
5913a34bf4808ec6631559c54c06b0a184a37c1f415f34673db8abf2261456f302024d394d1d1227c23fae55eb455a2c67e17de851eeee48b82c8d0ea700f77d

If I'm making some egregious error, please let me know.

Regards,
iain

[havenwood]

@yb66 It looks like Rubinius released 3.78 then yanked it and replaced it with a new 3.78. I'm not sure why they did that but in the past they've stated they might: rbenv/ruby-build#862 (comment)

[havenwood]

I've updated the checksums to point at the latest version of rubinius 3.78.

@yb66 Thanks for the heads-up!!

[yb66]

@havenwood Thank you.