26.06.1 checksum mismatch

[liv-io]

Hello,

The SHA256 checksum of the latest release 26.06.1 does not match the entry in SHA256SUMS-v26.06.1.

I've downloaded the tarball on 3 different Linux systems and got:
$ sha256sum clightning-v26.06.1-Ubuntu-22.04-amd64.tar.xz

19c50dcf39131c07d8439e9b7dce5c6629fb16255c94c2e89b87ddd82b6b4253  clightning-v26.06.1-Ubuntu-22.04-amd64.tar.xz

Steps to reproduce:

export LIGHTNING_VERSION="26.06.1"

install --directory --owner=root --group=root --mode=0755 /usr/local/src/lightning

curl --proto '=https' --tlsv1.3 \
        --location https://github.com/ElementsProject/lightning/releases/download/v${LIGHTNING_VERSION}/clightning-v${LIGHTNING_VERSION}-Ubuntu-22.04-amd64.tar.xz \
        --output /usr/local/src/lightning/clightning-v${LIGHTNING_VERSION}-Ubuntu-22.04-amd64.tar.xz
curl --proto '=https' --tlsv1.3 \
        --location https://github.com/ElementsProject/lightning/releases/download/v${LIGHTNING_VERSION}/SHA256SUMS-v${LIGHTNING_VERSION} \
        --output /usr/local/src/lightning/SHA256SUMS-v${LIGHTNING_VERSION}
curl --proto '=https' --tlsv1.3 \
        --location https://github.com/ElementsProject/lightning/releases/download/v${LIGHTNING_VERSION}/SHA256SUMS-v${LIGHTNING_VERSION}.asc \
        --output /usr/local/src/lightning/SHA256SUMS-v${LIGHTNING_VERSION}.asc

# Get and verify GPG keys from https://github.com/ElementsProject/lightning/blob/master/SECURITY.md

cd /usr/local/src/lightning
["/bin/bash", "-c", "gpg --no-default-keyring --keyring /root/lightning.gpg --verify SHA256SUMS-v${LIGHTNING_VERSION}.asc 2> >(grep 'Good signature') || true"]

cd /usr/local/src/lightning
sha256sum --ignore-missing --check SHA256SUMS-v${LIGHTNING_VERSION}

Could you kindly verify if it is just me? Thanks

[nGoline]

Thanks for catching this and providing the clear reproduction steps.

The root cause was a bug in our release CI: the signing step silently failed to generate the SHA256SUMS file for this release, so it was created manually, but against the wrong artifacts, resulting in every hash being incorrect.

This has now been fixed. The correct SHA256SUMS-v26.06.1 and SHA256SUMS-v26.06.1.asc files have been uploaded to the release, and signed with key A57656F8004F6FD68ED99C85BE277A87802A6F08. You can verify with:

curl -sL https://github.com/ElementsProject/lightning/releases/download/v26.06.1/SHA256SUMS-v26.06.1 -o SHA256SUMS-v26.06.1
curl -sL https://github.com/ElementsProject/lightning/releases/download/v26.06.1/SHA256SUMS-v26.06.1.asc -o SHA256SUMS-v26.06.1.asc
gpg --verify SHA256SUMS-v26.06.1.asc
sha256sum --ignore-missing --check SHA256SUMS-v26.06.1

There's already a fix for the CI (#9199) on its way, so SHA256SUMS is generated automatically for future releases.