MD5 mismatch

[Tim Byrne]

The MD5 sum reported by http://www.atlassian.com/software/crucible/downloads/binary/crucible-2.10.4.zip.md5 does not match the MD5 sum I calculate from the file hosted at http://www.atlassian.com/software/crucible/downloads/binary/crucible-2.10.4.zip.

Should I be concerned?

[lpater · Accepted solution]

Hi all,

it seems that our CDN has erroneously cached an earlier version of the release, causing some downloads to get that one and see the md5 mismatch. This should now be fixed and you should be able to download the matching release and md5 files.

The md5 checksums for the 2.10.4 release are:

f3827a01f04dcb72a83e61350cf1ba3c  crucible-2.10.4.zip
5a3fd2ce25193349e87de5d4f0331354  fisheye-2.10.4.zip

[CelsoA]

Hi Tim,

Please download it again the md5 signature is correct.

The md5sum for this file is f3827a01f04dcb72a83e61350cf1ba3c.

Regards.

[Tim Byrne]

Uh? When I request the MD5 sum file, it reports a different checksum:

$ GET http://www.atlassian.com/software/crucible/downloads/binary/crucible-2.10.4.zip.md5

d87ff34533a7debd18f4c63eedb2edd9 crucible-2.10.4.zip

I agree that the checksum you listed in your answer is the checksum of the file I've downloaded. But it doesn't match the file posted for verifying the checksum.

EDIT:To be clear; these don't agree

[rverschoor]

I've downloaded the zip and verified its MD5 matches the posted MD5:

[Downloads] $ openssl md5 crucible-2.10.4.zip
MD5(crucible-2.10.4.zip)= f3827a01f04dcb72a83e61350cf1ba3c
[Downloads] $ cat crucible-2.10.4.zip.md5 
f3827a01f04dcb72a83e61350cf1ba3c crucible-2.10.4.zip

[Tim Byrne]

OK, there must be some sort of caching going on. I just downloaded again, from multiple locations, and I find this content inside the MD5 file:

$ GET http://www.atlassian.com/software/crucible/downloads/binary/crucible-2.10.4.zip.md5

d87ff34533a7debd18f4c63eedb2edd9 crucible-2.10.4.zip

[Tim Byrne]

Yes, I think Atlassian's CDN is doing some caching. From our UK office, I can query the MD5 sum file, and it has the correct checksum. However, from Chicago I get the one ending in "dd9".

[Tim Byrne]

According to Atlassian, the correct MD5 sum is f3827a01f04dcb72a83e61350cf1ba3c. However, when you request the .md5 file, you may get an incorrect MD5 returned (ending in "dd9"). I suspect this isn't something that is going to be fixed.

EDIT: Atlassian cleared the cache.