Golang go1.14.7.linux-amd64.tar.gz checksum not matching

user_14033309 0
Viewed 430

https://golang.org/dl/ shows a different SHA256 checksum versus what I downloaded into my VPS:

go1.14.7.linux-amd64.tar.gz Archive Linux x86-64 118MB 4a7fa60f323ee1416a4b1425aefc37ea359e9d64df19c326a58953a97ad41ea5

I'm getting different values:

sha256sum go1.14.7.linux-amd64.tar.gz 353f6c251ab323f7435d107577f1504d3c4f74af4ebb06fa2d3c71fc7560f4f3 go1.14.7.linux-amd64.tar.gz

I downloaded it using

curl -O https://golang.org/dl/go1.14.7.linux-amd64.tar.gz

What's going on here? Is it possible the golang.org values are not updated? Man-in-the-middle attack or similar?

go checksum sha256 linux
1 Answers

The problem that you're seeing is due to not using the -L option, which performs automatic redirects. The link you use redirects to the real location and provides a stub HTML page to perform the redirection should you be using a browser that doesn't properly support the Location header. As a result, the hash you're getting is of a small, incomplete HTML file, not the real Go archive.

If I don't use the -L option, I get the result you reported; if I do, then I get the expected result as listed on the download page. Note that if you have a trusted, strong checksum or signature for an archive that you verify, it's always safe to use the -L option, since you're going to verify the archive manually and an attacker won't be able to tamper with it.

user_87054320
Related