sha256sum provided by releases.hashicorp.com are changing for 0.11.13

[maxwell-k]

TLDR; two commands, a few minutes apart give different checksums for 0.11.13:

$ curl --silent https://releases.hashicorp.com/terraform/0.11.13/terraform_0.11.13_SHA256SUMS | grep linux_amd64
5925cd4d81e7d8f42a0054df2aafd66e2ab7408dbed2bd748f0022cfe592f8d2  terraform_0.11.13_linux_amd64.zip
$ curl --silent https://releases.hashicorp.com/terraform/0.11.13/terraform_0.11.13_SHA256SUMS | grep linux_amd64
d57dd17c61a63073191503302ea44352ba7a274e2c7944c4b38b97477a347aa5  terraform_0.11.13_linux_amd64.zip

Terraform Version

0.11.13 if I could get it installed

Terraform Configuration Files

None relevant

Debug Output

None relevant

Crash Output

None relevant

Expected Behavior

The SHA256 checksum for a release artifact should be calculated at release time and should not change.

Actual Behavior

The SHA256 checksum for a release artifact changes depending on the time of the download.

Steps to Reproduce

$ curl --silent https://releases.hashicorp.com/terraform/0.11.13/terraform_0.11.13_SHA256SUMS | grep linux_amd64
5925cd4d81e7d8f42a0054df2aafd66e2ab7408dbed2bd748f0022cfe592f8d2  terraform_0.11.13_linux_amd64.zip
$ curl --silent https://releases.hashicorp.com/terraform/0.11.13/terraform_0.11.13_SHA256SUMS | grep linux_amd64
d57dd17c61a63073191503302ea44352ba7a274e2c7944c4b38b97477a347aa5  terraform_0.11.13_linux_amd64.zip

Sometimes the checksum for the downloaded zip file will match the first:

$ sha256sum terraform_0.11.13_linux_amd64.zip
d57dd17c61a63073191503302ea44352ba7a274e2c7944c4b38b97477a347aa5  terraform_0.11.13_linux_amd64.zip

And sometimes the second:

$ sha256sum terraform_0.11.13_linux_amd64.zip
5925cd4d81e7d8f42a0054df2aafd66e2ab7408dbed2bd748f0022cfe592f8d2  terraform_0.11.13_linux_amd64.zip

This behaviour has been seen both in a local development machine and a cloud VM.

Additional Context

None

References

Checksums are linked from the download page: https://www.terraform.io/downloads.html

[svanharmelen]

Very sorry you encountered this issue @maxwell-k. We pushed new zip files earlier today after getting feedback that the Solaris binaries did not got uploaded properly during the initial upload.

The issue you reported was caused by CDN caching, but should be solved now that the cache is purged. I'll close this issue, but feel free to reopen the it if you have any more question/issues regarding this.

[svanharmelen]

To be a bit more explicit, if a situation like this occurs again we plan to issue a new release and not re-issue a previous release.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.