Downloading from
Both torrent and direct link options for the normal xfce version produce the file with SHA-1 of
3ED1C2B59C517BCE2AB7E11F6F5AED9D58BA806C
But the SHA-1 listed under that link is
43f0f573d6c5d089cd280b622f228d1ea2933cf8
The minimal version also has the wrong hash:
E708396FE3388F9442DDF5CB8EEF9D9ED9AEB579
And the minimal LTS too:
FDEB8FF31B54B90CB41830A1A9D9530F58B463E7
Is it because of a man in the middle attack, or a mistake?
The KDE default version is fine, this seems to only affect the XFCE downloads…