[azure-firewall] azure-firewall extension 2.2.1 fails to install: checksum does not match the expected value

[azure-client-tools-agent]

Source: Azure/azure-cli#33726 (by @mkozikowsk)
Affected extension: azure-firewall (src/azure-firewall/)

---

<<UNTRUSTED:issue-33726>>

Issue #33726 (by @mkozikowsk)

Title

azure-firewall extension 2.2.1 fails to install: checksum does not match the expected value

Body

Describe the bug

Installing the azure-firewall CLI extension version 2.2.1 fails with a checksum
mismatch. The sha256Digest recorded in the extension index does not match the
SHA-256 of the actual .whl published in blob storage, so az extension add aborts.

Version 2.2.0 installs correctly, so this is specific to the 2.2.1 release
artifact/index entry.

Related command

az extension add --name azure-firewall --version 2.2.1

Errors

'''
ERROR: The checksum of the extension does not match the expected value. Use --debug for more information.
'''

Issue script & Debug output

'''
DEBUG: cli.azure.cli.core.extension._resolve: Chosen {'downloadUrl': 'https://azcliprod.blob.core.windows.net/cli-extensions/azure_firewall-2.2.1-py2.py3-none-any.whl', ... 'version': '2.2.1'}, 'sha256Digest': '1ff948c19b1579a0ee650595fb261cf7ac281a3dd60e461a501db942228e6f58'}
DEBUG: cli.azure.cli.core.extension.operations: Invalid checksum for ...\azure_firewall-2.2.1-py2.py3-none-any.whl. Expected '1ff948c19b1579a0ee650595fb261cf7ac281a3dd60e461a501db942228e6f58', computed 'ab86a2d1412ba8a23dec0f0e678fc992e4f540b38a6b7eab6193c8b62bb5afdb'.
knack.util.CLIError: The checksum of the extension does not match the expected value. Use --debug for more information.
'''

Details:

• Download URL: https://azcliprod.blob.core.windows.net/cli-extensions/azure_firewall-2.2.1-py2.py3-none-any.whl
• Expected SHA-256 (from extension index): 1ff948c19b1579a0ee650595fb261cf7ac281a3dd60e461a501db942228e6f58
• Computed SHA-256 (of downloaded file): ab86a2d1412ba8a23dec0f0e678fc992e4f540b38a6b7eab6193c8b62bb5afdb

The mismatch indicates the published .whl and the index entry are out of sync
(the blob was likely re-uploaded without updating the index sha256Digest, or vice versa).

Expected behavior

az extension add --name azure-firewall --version 2.2.1 installs successfully,
i.e. the index sha256Digest matches the SHA-256 of the published .whl.

Environment Summary

{
"azure-cli": "2.78.0",
"azure-cli-core": "2.78.0",
"azure-cli-telemetry": "1.1.0",
"extensions": {
"azure-devops": "1.0.4",
"azure-firewall": "2.2.0",
"bastion": "1.4.3",
"log-analytics": "1.0.0b1",
"resource-graph": "2.1.1"
}
}

Additional context

No response

Comments

Comment by @azure-client-tools-bot-prd[bot]

Hi @mkozikowsk,

2.78.0 is not the latest Azure CLI(2.88.0).

If you haven't already attempted to do so, please upgrade to the latest Azure CLI version by following https://learn.microsoft.com/en-us/cli/azure/update-azure-cli.

Comment by @yonzhan

Thank you for opening this issue, we will look into it.
<<END:issue-33726>>

[yonzhan]

Thank you for opening this issue, we will look into it.

[avanigupta]

I have the same problem installing the latest version of serviceconnector-passwordless extension.
@yanzhudd @yonzhan

az extension add -n serviceconnector-passwordless

The checksum of the extension does not match the expected value. Use --debug for more information.

[necusjz]

@avanigupta it's fixed, please try again after a while.

[mkozikowsk]

@avanigupta it's fixed, please try again after a while.

Is it fixed only for the ‚serviceconnector-passwordless’ extension or for the ‚azure-firewall’ as well?