TW: libmbedcrypto16-3.6.6-1.2.x86_64.rpm - wrong checksum?

Peter Maffter via openSUSE Users <[email protected]> Tue, 7 Jul 2026 21:06:23 +0200

Newsgroups	gmane.linux.suse.general
Message-ID	<[email protected]>

zypper refresh
zypper dup

shows:
...
Retrieving: libmbedcrypto16-3.6.6-1.2.x86_64 (openSUSE-Tumbleweed-Oss) 
  
                         (620/6303), 617.1 KiB
Retrieving: libmbedcrypto16-3.6.6-1.2.x86_64.rpm 
.............................................................................................................................................[done 
(275.5 KiB/s)]

Warning: Digest verification failed for file 'libmbedcrypto16-3.6.6-1.2.x86_64.rpm'
[/var/tmp/zypp.tmp/AP_0xaQAIRD/x86_64/libmbedcrypto16-3.6.6-1.2.x86_64.rpm]

   expected 
1521a56b09dc64e6c5511d8f3111c58a3b1bdb63ce0535273099fab5ecf2cf82aa1c946529d07d2a02b68654374192fd267df90ad3d3ab260631e79fe4c261af
   but got 
f1905f58ec69b547e379a6b4181715105d740553682932ab1f581fd70135073288647b2473590a3b18fc7463ae1b0fb3f1b93332a0c838babe45ad3c4f07475f

Accepting packages with wrong checksums can lead to a corrupted system and in 
extreme cases even to a system compromise.


Is that a security issue or just some wrong repos?