fluent-bit icon indicating copy to clipboard operation
fluent-bit copied to clipboard
verified publisher icon fluent

Out of date hash between the binary and the sha files

Open joshl621 opened this issue 5 months ago • 4 comments

Bug Report

Describe the bug From this link https://packages.fluentbit.io/windows/ the fluentbit 4.0.4 files between the .zip and sha file a mismatch of the hash. it appears that the exe was updated but the file containing the hash is not updated.

To Reproduce Download both files and compare the hash

Expected behavior The hash should match

Screenshots Image

joshl621 avatar Jul 22 '25 09:07 joshl621

The .zip as well as the .exe comparing to it's respective sha file does not match up. The timestamp of the sha file has the later date then the .exe. It should be the other way around.

joshl621 avatar Jul 22 '25 09:07 joshl621

Is it the reason why there's no Docker image for Windows 2019 after 4.0.3 ? There's no Docker image also for Windows 2022 after 4.0.4

Corbeau3000 avatar Aug 14 '25 16:08 Corbeau3000

This issue is stale because it has been open 90 days with no activity. Remove stale label or comment or this will be closed in 5 days. Maintainers can add the exempt-stale label.

github-actions[bot] avatar Nov 18 '25 02:11 github-actions[bot]

The current versions for Windows (4.2.0) also don't match the published SHA256 hashes. Every single file has a different hash! And as stated before by @joshl621 the last-modified http-header show that the first the .sha256 file is modified and one day later the .zip file itself

curl -sI https://packages.fluentbit.io/windows/fluent-bit-4.2.0-win64.zip | grep last-m last-modified: Wed, 12 Nov 2025 00:03:56 GMT curl -sI https://packages.fluentbit.io/windows/fluent-bit-4.2.0-win64.zip.sha256 | grep last-m last-modified: Tue, 11 Nov 2025 17:51:27 GMT`

Hash according website: https://docs.fluentbit.io/manual/installation/downloads/windows#installation-packages

for file fluent-bit-4.2.0-win64.zip d3f85aec36cf8d2977bc9224fdea109f7de2de86720388e1f432057ac9380793

my hash: 4bcb638df0c579a46e75be919ba677491d2313efc989b32fdb86de13d8b58cdd

I also made sure, that the error is not dependend on my computer / internet provider. VirusTotal shows the same hash as on my local computer, and they are different from the published ones.

https://www.virustotal.com/gui/url/8d360fdc279bbcbc80496d4c5a5255c4ea817083fd3644a8440baebdc46fb0a6/details

I would be great, if anyone at least can confirm the behaviuor.

denishol avatar Nov 25 '25 09:11 denishol