[LOG4J2-2907] Binary Download SHA512 sums do not match zip and tar.gz) binary packages

• Type: Bug
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: 2.13.3
• Component/s: Build, Documentation
• Labels: security
• Assignee: Unassigned
• Reporter: Ryan Russo
• Created: 11/Aug/20 18:20
• Updated: 11/Aug/20 18:20

Description

• SHA512 sums do not match corresponding Binary package SHA512 sums:
  https://logging.apache.org/log4j/2.x/download.html
• Format of the SHA512 sum files is not compatible w/ Linux sha512sum "-c" option.
• Manually producing a sha512sum for a given package and manually comparing to the corresponding binary package checksum file shows the sums do not match.

Attached is my attempts to download and verify Log4j 2 binary packages against the SHA512 sums from the same downwload page.

If it is me, I'm can't figure out where I'm going wrong.

Thank you for your time,
scarytshirt