Arch Linux User Repository

Removing the cached file helped. Pretty annoying when upstream changes contents without changing versions.

@gdamjan - it's in a numbered subdirectory if you look, the problem is a vendor is secretly replacing one archive file with another by the same name, something which Amazon has done before with this package if you read past comments. The only real solution is to wait a bit until the final one reveals itself then update the PKGBUILD to match what everyone sees. A vendor really should not be doing what they do, the shasum of a released (tarball, package, etc.) should never change - you bump the version if you do that, which they do not - it appears that they just repackage and overwrite the same named file.

2021-03-24 23:00 UTC - the archive downloaded from my laptop just now matches the same sha512sum as when I built the update about 23h ago; no change here yet, PKGBUILD working

ahh, the archive seems to have been cached. maybe change source=($pkgname-$pkgver.deb::…the url)

b581e68546f102df1b196feeb852f5029495c8c5671efa4493b0ede4b7acb5daa6ded4fd632dfe5d17c2439e20c016597ce5ec0d08eb4209ce81f17767b94238 session-manager-plugin.deb

@languitar - this has happened before with Amazon's download, I just updated my work laptop and it validated fine. I suspect that (a) they swapped out the package with a hidden fix, and (b) there's a geo-based CDN delivering the download and I'm getting one version of the DEB, you're getting another version as the CDNs are not in sync (as it's the same filename, one of them simply skipped re-syncing it).

Since it's passing sha512sum for me just now, I'll assume this laptop hit the same CDN as my other machine last night - for now, you can just edit the pkgbuild until they converge upstream and we get the same DEB file (sha512) for everyone... (and we can update the pkgbuild when the dust settles, if needed)

For me, the validity check fails now

P67 must be out right now, backup maintainer here - I updated to the new 1.2.54.0 release and deprecated 32bit support while I was in there.

Huh, That's typical.

I updated the package with the sha512sum makepkg -g gave back. That URL is the same it had gotten, but gives back a wholly different sha512sum as the curl apparently. To make it even more wonky, I do get the b581... sum now.

Should be fixed in the 1.2.30.0-2 released just now!

@Canha I confirm the same, AWS has updated the same-named package in some way which has changed the SH512 signature, this is not the first time this has happened. Until @P67 gets a moment to update the PKGBUILD for us, use curl and calculate it manually and update your PKGBUILD:

$ curl -sO https://s3.amazonaws.com/session-manager-downloads/plugin/1.2.30.0/ubuntu_64bit/session-manager-plugin.deb

$ sha512sum session-manager-plugin.deb 
b581e68546f102df1b196feeb852f5029495c8c5671efa4493b0ede4b7acb5daa6ded4fd632dfe5d17c2439e20c016597ce5ec0d08eb4209ce81f17767b94238  session-manager-plugin.deb

...is what I'm seeing as of this writing.

Currently getting:

==> Retrieving sources...
  -> Found session-manager-plugin.deb
==> Validating source_x86_64 files with sha512sums...
    session-manager-plugin.deb ... FAILED
==> ERROR: One or more files did not pass the validity check!
error downloading sources: aws-session-manager-plugin