SHASUM mismatch for node-v4.6.0.pkg

[ghost]

• URL: https://nodejs.org/dist/v4.6.0/node-v4.6.0.pkg
• Browser version: Safari 10.0
• Operating system: OS X 10.11.6

shasum Downloads/node-v4.6.0.pkg

c4a21a5c01b8146dd87fa988f259e8736010ac18 Downloads/node-v4.6.0.pkg

... is not equal to listed shasum at https://nodejs.org/dist/v4.6.0/SHASUMS256.txt.asc

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

525ab42c767525edb7e512c600dedb20d826a6f58e1d6d1b774651a1c782a267 node-v4.6.0-darwin-x64.tar.gz
3c728c25b541fd8b88826568e7867098658df7c45d2389b60877c093a9803bd0 node-v4.6.0-darwin-x64.tar.xz
5eb4b4324d72297066b4b8c91d0b1e7c82cabde9986c986682be66202f37176b node-v4.6.0-headers.tar.gz
862ce573bcfd592ea0c24861c0097bd23ca842d263e03f5dfa1ce08be888f20f node-v4.6.0-headers.tar.xz
bf03e7384b727bc80c0c59cf38ba5704d83faa7f455f40fa62a67c8331dde7d6 node-v4.6.0-linux-arm64.tar.gz
7683e664b648c4ec3f86935f4b4f9fbf56f19d171e1e29d5adf687fc4c392b5b node-v4.6.0-linux-arm64.tar.xz
e7db1c612eb9dd55e3ff246bfa7c35f0b87664e6e2bc7b32891de8cc1e48f5a7 node-v4.6.0-linux-armv6l.tar.gz
766d10a73886bbe1a3abd4b78563a825408cab7e116e590f1bbdc9b88cc3aa09 node-v4.6.0-linux-armv6l.tar.xz
9e46082bef5b521afd483532c8d3715f33d1d4302b7980b904bea3182817275f node-v4.6.0-linux-armv7l.tar.gz
def976771b4a2a4488b87a06c8295ffea55671f7f42df13e3718341d28bf2d40 node-v4.6.0-linux-armv7l.tar.xz
2aa9518ea637cc06877a01c40d4608cf9a7f1588000cf3e550e4ab24c170aee6 node-v4.6.0-linux-ppc64le.tar.gz
b06c39da4fae47e2d204cae183425a3a77849944c5be47c5807f4f08cef51f64 node-v4.6.0-linux-ppc64le.tar.xz
ee77fb6a1dfbe166c9faee25b4f110af25723c64b0abcb9085507b8445fa2e7b node-v4.6.0-linux-ppc64.tar.gz
e35955a846c1082e1681fdcbf488a66e43f56fb0aa7205b86a4aa0ce69dfb1eb node-v4.6.0-linux-ppc64.tar.xz
acf08148cecf245f28126122ac9128ff9909f00938b18d80fc0b92648d1c98a8 node-v4.6.0-linux-x64.tar.gz
a77ceb75a05984153304ad0f09b11d234ca54a67714ba575b52e4298df0343d1 node-v4.6.0-linux-x64.tar.xz
9aab75618de0dca640d747aa25073cbb5a01342dd8aa177df8112e26a39541f4 node-v4.6.0-linux-x86.tar.gz
8994ee2c180a97fc4280bfb390444a4bcb2629290aa8243e7ab6271efab593f4 node-v4.6.0-linux-x86.tar.xz
0359c50c5d7e887c7f17d7ea4f42b1776ac8df263c6471bf8054b5c9f3d42a67 node-v4.6.0.pkg
e9a02da71d0cd6a1874f4a7d227dfcbe6ab9492eba419b5c9a83c8c95065195f node-v4.6.0-sunos-x64.tar.gz
8ea3d2887b4850fb92f75573f30bbb257b7cd11f71cda12becc34868c535acf8 node-v4.6.0-sunos-x64.tar.xz
f8536a25629ef1ad3228b2d712e2fa43bf66980673d3cdf469da37c0407e9633 node-v4.6.0-sunos-x86.tar.gz
5750a8256356f43c6b80854b7c6ce46d6933e64cf5f2efecdf4841e4fe582a28 node-v4.6.0-sunos-x86.tar.xz
0838f12e329edb252e6e6baddca85632bf5ff2ec900e737e88f9bf9b38946b1b node-v4.6.0.tar.gz
42910dbd34e49bfc40580e06753947c30d31101455a38e9f0343a23d67c0c694 node-v4.6.0.tar.xz
0c6509c13cfa9795f08b9bf694383de7e4d93cde14a9e8979a92f21736e19498 node-v4.6.0-win-x64.7z
0782bd50251c2a159fba5b874c56fb4a6680f454cc16892cee8e62d17b7d6f60 node-v4.6.0-win-x64.zip
413f98f2b765fe862ff6971724c3f265dbfe5a2cb865dd1894b4447426542c91 node-v4.6.0-win-x86.7z
13a5dcb90a8397f62c55945b65cb1c7b9d7576af3cbfc8d9cb67f72edcf68201 node-v4.6.0-win-x86.zip
80926b2df6e7efc8adda2e1fcb6328b99fe878d728cf93f39b0c710adc1bcb35 node-v4.6.0-x64.msi
5f91bf57512c1fa96d016c8f6236c689998ed926faa13aaf2170154342ca915a node-v4.6.0-x86.msi
7564472c672e729a724ffe890ba06ec318c9e311684516a25a47b3f1e549504e win-x64/node.exe
24178152fc3a99b9b83a1620897c5624cb7e0ba0544da38e18ca0cde807435d4 win-x64/node.lib
44dbbec125f3c4804ed5d002628c7ddb8e51cd352af0542b9edebcfd718967b5 win-x64/node_pdb.7z
b92e5e5031f19f201ec4568d7761c263af9a20e02b34bdd9e5f7191750aee3fb win-x64/node_pdb.zip
7c9287cec4379082393d85af919a36a3512aa6bfcbf3deba3261a472580041f8 win-x86/node.exe
7d5988939f1567a4d7180010f49ec36b8d3897a8eccb78e461a774d8d2de614e win-x86/node.lib
98f955f69195f12ec429e4cff629c650a6b1dcb43a1c18cef9cf79a11067c88d win-x86/node_pdb.7z
0d0faf3bf0fcf50a943d8202d24d8eb8bb0695ea99498360c1a8a745c7811fd7 win-x86/node_pdb.zip
-----BEGIN PGP SIGNATURE-----

iQEcBAEBAgAGBQJX6xhwAAoJEMJzeS99g1RdoksH/139ljOj+Vjc0nVNRn5m2KxC
3gldiKMaNBeefV9JOA3tG1fei3KPvO/PRHVCYogQO8IEEpJ5Yer+zQpsLOg/xGDR
nsg9xOBupnSlUAfALilWhkDkBDgcauuiII3tP98GjDaSS+cH6Pctt08l2XTCROYk
YThc0nonmobDGSsHVf4biv+ySMocmpZGU0h10xS2lRVlrxMpEzsxVuCSv52fRDKy
gD0Hf9ZSFi9i1MIxKOIolYpdIVmrS29c6J0LbjW2WcTk21jIOENXEk1uEl71OWHD
plT4hauehu/3a89FcqsOu10MqLStFuEm0T1CXtmn4/Vm2FhJnZfdiCDT1YABD00=
=LyAk
-----END PGP SIGNATURE-----

[MylesBorins]

@Quelltexter it would appear that you are checking the SHA1 not the SHA256

$ shasum node-v4.6.0.pkg
c4a21a5c01b8146dd87fa988f259e8736010ac18  node-v4.6.0.pkg
$ shasum -a 256 node-v4.6.0.pkg
0359c50c5d7e887c7f17d7ea4f42b1776ac8df263c6471bf8054b5c9f3d42a67  node-v4.6.0.pkg

You can find instructions for verifying the binary in our readme

For OSX

$ grep node-v4.6.0.tar.gz SHASUMS256.txt | shasum -c -

I'm going to close this, but feel free to ask any questions

[ghost]

Oh, I see, but why starts the list with this:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[MylesBorins]

/cc @rvagg

[rvagg]

Yeah, that's confusing sorry about that, that 'Hash: SHA1' is output from gpg and only relates to the signing of the file, not the shasums of the individual files! We might be able to change the digest algorithm when signing though. This isn't the first time it's caused confusion!

[rvagg]

improvement @ nodejs/node#9071 to make it say Hash: SHA256

[ghost]

Thank you for clarification. I had the impression, both hash algorithm had been used the other way around (without careful inspection of hash length). So, in the end it is the way gpg works, that brings up some kind of confusion. Maybe a switch to a public shasum git repository is an alternative way to protect the shasum list. Anyway thanks to both of you for the quick support in this case.