Ask HN: GitHub Download Hash Change?

13 points

4 years ago

Today, an issue was raised in one project I use, because their build system rejected an invalid sha256sum while downloading a dependency from a GitHub zip file.

The offending dependency is usrsctp (https://github.com/sctplab/usrsctp) at commit 9d6b99b:

https://github.com/sctplab/usrsctp/archive/9d6b99b10a70f7a63d21cd80d03c353da9ac19d3.zip

This file's sha256sum has always been

    d9b7b3350ea0be2a3d1437e404d4852df741c4984b734729c5edc337ff4b7611

but suddenly today it changed to

    e86fe0b8aabef0eae207a94a5525da303e90477c37fce272c84e2d87d7ac169b

This lasted a couple hours, and it is now back to the original hash. Does this mean that the project might have been compromised somehow? Or are there any other less alarming explanations for what has happened?

6 comments