Prebuilt RHEL/CentOS/Oracle 9 for AMD64 signatures do not match in the prebuilt packages download page

Hello,

I was looking to download the prebuilt RPMs from the website (
https://www.sudo.ws/getting/packages/) and it seems that all of the amd64
builds for RHEL9 and friends had mismatching sha256sums, and they have no
GPG signatures, despite the page saying the RPMs should be signed with two
GPG keys.

It's possible that I'm making a mistake, but I thought I'd send a message
in case I'm not.

[root@ju1f2mb4-trk-14-1 ~]# cat reproduction
#!/usr/bin/env bash

set -x

curl -sLO
https://github.com/sudo-project/sudo/releases/download/SUDO_1_9_15p5/sudo-1.9.15-6.el9.x86_64.rpm
curl -sLO
https://github.com/sudo-project/sudo/releases/download/SUDO_1_9_15p5/sudo-logsrvd-1.9.15-6.el9.x86_64.rpm
curl -sLO
https://github.com/sudo-project/sudo/releases/download/SUDO_1_9_15p5/sudo-python-1.9.15-6.el9.x86_64.rpm
curl -sLO
https://github.com/sudo-project/sudo/releases/download/SUDO_1_9_15p5/sudo-1.9.15-6.el9.aarch64.rpm
curl -sLO
https://github.com/sudo-project/sudo/releases/download/SUDO_1_9_15p5/sudo-logsrvd-1.9.15-6.el9.aarch64.rpm
curl -sLO
https://github.com/sudo-project/sudo/releases/download/SUDO_1_9_15p5/sudo-python-1.9.15-6.el9.aarch64.rpm

rpm -qi \
  ./sudo-1.9.15-6.el9.x86_64.rpm \
  ./sudo-logsrvd-1.9.15-6.el9.x86_64.rpm \
  ./sudo-python-1.9.15-6.el9.x86_64.rpm \
  ./sudo-1.9.15-6.el9.aarch64.rpm \
  ./sudo-logsrvd-1.9.15-6.el9.aarch64.rpm \
  ./sudo-python-1.9.15-6.el9.aarch64.rpm \
| awk '-F:' '$0 ~ "Signature"'

sha256sum -c <<EOF
3e962a5dfddbd563e1461266a98bf4a7a8250c232b95aea3f8f2f32b9c6e6e64
 ./sudo-1.9.15-6.el9.x86_64.rpm
23bd7305f074585f2dc9785dd0891e96817503740b2cc50ed54c073e847aa2da
 ./sudo-logsrvd-1.9.15-6.el9.x86_64.rpm
4bd2fab6250ad3e035151fa4a2146309b6d71c1bb9ed0d2b6de9c0fc545be655
 ./sudo-python-1.9.15-6.el9.x86_64.rpm
ade1b5d5f164dc07ced14d767d4a2e6488a9a8beff8bd8e7d0ad78306c854154
 ./sudo-1.9.15-6.el9.aarch64.rpm
855af6fde81722f96346e36e5c863358d1ac8ebd086a07cab074661d5b9fdd9d
 ./sudo-logsrvd-1.9.15-6.el9.aarch64.rpm
321f2b9dc152805405b0bc9eeef98111df1d8dae8443ff712ccc697f2f89f91b
 ./sudo-python-1.9.15-6.el9.aarch64.rpm
EOF
[root@ju1f2mb4-trk-14-1 ~]# ./reproduction
+ curl -sLO
https://github.com/sudo-project/sudo/releases/download/SUDO_1_9_15p5/sudo-1.9.15-6.el9.x86_64.rpm
+ curl -sLO
https://github.com/sudo-project/sudo/releases/download/SUDO_1_9_15p5/sudo-logsrvd-1.9.15-6.el9.x86_64.rpm
+ curl -sLO
https://github.com/sudo-project/sudo/releases/download/SUDO_1_9_15p5/sudo-python-1.9.15-6.el9.x86_64.rpm
+ curl -sLO
https://github.com/sudo-project/sudo/releases/download/SUDO_1_9_15p5/sudo-1.9.15-6.el9.aarch64.rpm
+ curl -sLO
https://github.com/sudo-project/sudo/releases/download/SUDO_1_9_15p5/sudo-logsrvd-1.9.15-6.el9.aarch64.rpm
+ curl -sLO
https://github.com/sudo-project/sudo/releases/download/SUDO_1_9_15p5/sudo-python-1.9.15-6.el9.aarch64.rpm
+ rpm -qi ./sudo-1.9.15-6.el9.x86_64.rpm
./sudo-logsrvd-1.9.15-6.el9.x86_64.rpm
./sudo-python-1.9.15-6.el9.x86_64.rpm ./sudo-1.9.15-6.el9.aarch64.rpm
./sudo-logsrvd-1.9.15-6.el9.aarch64.rpm
./sudo-python-1.9.15-6.el9.aarch64.rpm
+ awk -F: '$0 ~ "Signature"'
Signature   : (none)
Signature   : (none)
Signature   : (none)
Signature   : (none)
Signature   : (none)
Signature   : (none)
+ sha256sum -c
./sudo-1.9.15-6.el9.x86_64.rpm: FAILED
./sudo-logsrvd-1.9.15-6.el9.x86_64.rpm: FAILED
./sudo-python-1.9.15-6.el9.x86_64.rpm: FAILED
./sudo-1.9.15-6.el9.aarch64.rpm: OK
./sudo-logsrvd-1.9.15-6.el9.aarch64.rpm: OK
./sudo-python-1.9.15-6.el9.aarch64.rpm: OK
sha256sum: WARNING: 3 computed checksums did NOT match

I suppose most people are probably building sudo from source or installing
it from a package manager who's likewise building it from source, so it's
probably not a huge deal, even if I'm not making a mistake on my end.
____________________________________________________________
sudo-users mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-users