ISO from site (both direct link and torrent) have the same hash - but not the one listed

Downloading from
https://manjaro.org/downloads/official/xfce/

Both torrent and direct link options for the normal xfce version produce the file with SHA-1 of

3ED1C2B59C517BCE2AB7E11F6F5AED9D58BA806C

But the SHA-1 listed under that link is

43f0f573d6c5d089cd280b622f228d1ea2933cf8

The minimal version also has the wrong hash:

E708396FE3388F9442DDF5CB8EEF9D9ED9AEB579

And the minimal LTS too:

FDEB8FF31B54B90CB41830A1A9D9530F58B463E7

Is it because of a man in the middle attack, or a mistake?

The KDE default version is fine, this seems to only affect the XFCE downloads…

You know, it really doesn’t hurt to look around at the forum before posting. The issue has already been reported several times now. :arrow_down:

2 Likes