Hash Sum mismatch on Ubuntu Trusty Packages.gz

Super super sorry, I know y’all are mopping up after the CVE earlier this week and I bet this is just collateral damage from that. Thanks so much for all that you do.

tl;dr I’m guessing Release.gpg at https://packages.microsoft.com/repos/microsoft-ubuntu-trusty-prod/dists/trusty/ didn’t get updated when the new packages went out? It has an older mtime than all the other files.

Steps to reproduce

1. Follow the instructions here to install the Microsoft GPG key and add the Microsoft apt source for Ubuntu Trusty (14.04): https://docs.microsoft.com/en-us/dotnet/core/linux-prerequisites?tabs=netcore2x#install-net-core-for-ubuntu-1404-ubuntu-1604-ubuntu-1610--linux-mint-17-linux-mint-18-64-bit

2. Install dotnet-sdk-2.0.0:

     sudo -E apt-get -yq --no-install-suggests --no-install-recommends --force-yes install dotnet-sdk-2.0.0
   

Expected behavior

Package installs!

Actual behavior

sudo -E apt-get -yq --no-install-suggests --no-install-recommends --force-yes install dotnet-sdk-2.0.0
Reading package lists...
Building dependency tree...
Reading state information...
E: Unable to locate package dotnet-sdk-2.0.0
E: Couldn't find any package by glob 'dotnet-sdk-2.0.0'
E: Couldn't find any package by regex 'dotnet-sdk-2.0.0'
apt-get.diagnostics
apt-get install failed
$ cat ~/apt-get-update.log
Ign:1 http://repo.mongodb.org/apt/ubuntu trusty/mongodb-org/3.4 InRelease
Hit:2 http://repo.mongodb.org/apt/ubuntu trusty/mongodb-org/3.4 Release
Ign:4 http://dl.google.com/linux/chrome/deb stable InRelease
Hit:6 http://dl.google.com/linux/chrome/deb stable Release
Ign:3 http://toolbelt.heroku.com/ubuntu ./ InRelease
Hit:7 http://toolbelt.heroku.com/ubuntu ./ Release
Hit:9 https://dl.hhvm.com/ubuntu trusty InRelease
Hit:11 http://apt.postgresql.org/pub/repos/apt trusty-pgdg InRelease
Hit:12 http://ppa.launchpad.net/chris-lea/redis-server/ubuntu trusty InRelease
Hit:13 http://security.ubuntu.com/ubuntu trusty-security InRelease
Get:15 https://packages.microsoft.com/repos/microsoft-ubuntu-trusty-prod trusty InRelease
Ign:16 http://ppa.launchpad.net/couchdb/stable/ubuntu trusty InRelease
Get:17 https://packages.microsoft.com/repos/microsoft-ubuntu-trusty-prod trusty/main amd64 Packages [28.8 kB]
Err:17 https://packages.microsoft.com/repos/microsoft-ubuntu-trusty-prod trusty/main amd64 Packages
  Hash Sum mismatch
Hit:18 http://ppa.launchpad.net/git-core/ppa/ubuntu trusty InRelease
…
Fetched 3,168 B in 3s (795 B/s)
Reading package lists...
…
E: Failed to fetch https://packages.microsoft.com/repos/microsoft-ubuntu-trusty-prod/dists/trusty/main/binary-amd64/Packages.gz  Hash Sum mismatch
E: Some index files failed to download. They have been ignored, or old ones used instead.

Environment data

Description: Ubuntu 14.04.5 LTS Release: 14.04 Codename: trusty

dotnet --info output: Not available, can’t install. 😬

[pnc]

Oh, the repository files all got updated at 20:48, including Release.gpg. I think that did the trick, the package installs fine now on the original machine!

[pnc]

Before:

After: