Re: [ANNOUNCE] QEMU 8.2.3 Stable released

[Cal Peake]

On Sat, 4 May 2024, Michael Tokarev wrote:

> The initial issue you wrote about is that one of them does not verify.
> But if the two files are the same, they both should verify exactly the
> same way too (file timestamp isn't covered by the signature).

Ah, you're right. I should have clarified that the tarballs are the same 
after downloading, but the signature files are unique and therefore do not 
both verify as good.

> So it looks like there are actually two files there, which differ not
> only in timestamp but also in contents.

I see that now too. They should be different based on size alone, but the 
server doesn't seem to be serving the replacement archive. CDN issues is a 
good thought.

> Another issue here is that I've seen the .xz file has changed on the
> site and noticed it has different size too, so I re-downloaded it
> and the signature, and made debian package out of it.  Now I see
> that the file I downloaded also has this directory in question
> (subprojects/dtc/).

Sounds like you're seeing the same behavior too. Glad I'm not going crazy.

Thanks for your help, Michael

-- 
Cal Peake