MD5 checksum is not valid for v2.7.16 "Windows x86-64 MSI installer"

[andrejs-sisojevs-accenture]

BPO	36241
Nosy	@benjaminp, @jkloth, @zooba, @tirkarthi

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2019-03-09.19:58:33.609>
created_at = <Date 2019-03-08.16:14:06.622>
labels = ['expert-installation']
title = 'MD5 checksum is not valid for v2.7.16 "Windows x86-64 MSI installer"'
updated_at = <Date 2019-03-10.16:58:19.743>
user = 'https://bugs.python.org/andrejs-sisojevs-accenture'

bugs.python.org fields:

activity = <Date 2019-03-10.16:58:19.743>
actor = 'steve.dower'
assignee = 'none'
closed = True
closed_date = <Date 2019-03-09.19:58:33.609>
closer = 'SilentGhost'
components = ['Installation']
creation = <Date 2019-03-08.16:14:06.622>
creator = 'andrejs-sisojevs-accenture'
dependencies = []
files = []
hgrepos = []
issue_num = 36241
keywords = []
message_count = 13.0
messages = ['337502', '337504', '337510', '337512', '337514', '337525', '337526', '337577', '337578', '337580', '337602', '337603', '337621']
nosy_count = 6.0
nosy_names = ['benjamin.peterson', 'jkloth', 'SilentGhost', 'steve.dower', 'xtreak', 'andrejs-sisojevs-accenture']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = None
url = 'https://bugs.python.org/issue36241'
versions = ['Python 2.7']

[andrejs-sisojevs-accenture]

On download page
https://www.python.org/downloads/release/python-2716/
MD5 checksum for "Windows x86-64 MSI installer" is 2fe86194bb4027be75b29852027f1a79

But download file checksum is 2841e92ba89a6f036305a8a07fbe9d18.
Checksum calculated on 2 different machines (Windows and MacOS), both strongly protected by antiviruses.

[andrejs-sisojevs-accenture]

Checksum for earlier v2.7.15 is fine.

[tirkarthi]

The download page linked doesn't contain checksum 2fe86194bb4027be75b29852027f1a79. The checksum in the page is 2841e92ba89a6f036305a8a07fbe9d18 and I can confirm that the downloaded binary also has the correct checksum as below :

karthi@ubuntu-s-1vcpu-1gb-blr1-01:$ wget https://www.python.org/ftp/python/2.7.16/python-2.7.16.amd64.msi
karthi@ubuntu-s-1vcpu-1gb-blr1-01:$ md5sum python-2.7.16.amd64.msi
2841e92ba89a6f036305a8a07fbe9d18 python-2.7.16.amd64.msi

From https://www.python.org/downloads/release/python-2716/

Windows x86-64 MSI installer Windows for AMD64/EM64T/x64 2841e92ba89a6f036305a8a07fbe9d18 20348928 SIG

[jkloth]

When I visit the provided link, I also see what OP describes.

Is it a caching/location issue? I'm in US-Colorado.

[tirkarthi]

Strange, when I visit the link again in new tab then it gives me the checksum as described by OP. But I still have the old tab open with which I wrote my comment that has 2841e92ba89a6f036305a8a07fbe9d18 (20348928 bytes) and wget at the time also had this checksum as in my comment. I am in India.

[zooba]

We updated the build to be properly code signed, but the CDN may still be caching the old release.

Nothing has changed except the signature on the installer (Python 2 binaries have never been signed). I'll run a CDN purge to try and clear it up.

[zooba]

I redownloaded and confirmed that the files are correct.

Benjamin - the MD5 for the 32-bit installer didn't get updated. It should be 912428345b7e0428544ec4edcdf70286 (as in my updated email I sent).

[benjaminp]

I think everything is correct now?

[SilentGhost]

I still see 2fe86194bb4027be75b29852027f1a79 as checksum

[benjaminp]

That's correct.

[andrejs-sisojevs-accenture]

Please confirm, that old "2fe86194bb4027be75b29852027f1a79" was valid in past (as opposed to be security compromised). We need to make sure, since some of our devs downloaded and used that version with unconfirmed checksum.

[andrejs-sisojevs-accenture]

Oh, and also (please confirm) that 2841e92ba89a6f036305a8a07fbe9d18 was not security compromised.

[zooba]

Confirmed. Neither was compromised, the only change was that the previous MSI did not have an embedded Authenticode signature.

I didn't even rebuild the MSI, tbh. I went back to my (secure, controlled) build machine and signed it manually.