(firefoxesr) Checksum fails when multiple locales match

[miquelbonastreguillen]

Checklist

• I have verified that this is the correct repository, and the package is maintained by the chocolatey-community user.
• I have verified that this is happening in the latest available version of the package.

Chocolatey Version

2.6.0

Chocolatey License

None

Package Version

140.8.0

Current Behaviour

This bug has been present for a while (since I started using chocolatey to install firefox, aprox 2-3 years).
I use "firefoxesr", but other mozilla packages could be affected.

Installing firefoxesr with locale "ca" fails the checksum validations.

PS C:\WINDOWS\system32> choco install firefoxesr -y
Chocolatey v2.5.1
Installing the following packages:
firefoxesr
[...]
FirefoxESR v140.8.0 [Approved]
FirefoxESR package files install completed. Performing other installation steps.
Using locale 'ca'...
Downloading FirefoxESR 64 bit
  from 'https://download.mozilla.org/?product=firefox-140.8.0esr-ssl&os=win64&lang=ca'
[...]
Error - hashes do not match. Actual value was '0C9EE98C6C6B7044EC188DB2C0564C6869E44FC8344FBD2D12DDD92BB8D5A9E7949557D2237F2CFC73835DAB0D4C119E448A7141B890B9811EF4113977D10839'.
ERROR: Checksum for 'C:\Users\it\AppData\Local\Temp\chocolatey\FirefoxESR\140.8.0\Firefox Setup 140.8.0esr.exe' did not meet 'a866522efc851fc37b7719881de7a8818f4591e13a69418bda9dec39cc58a9e6ee18f47cd35cf154964c2a27af8e4e2b0cdabf38a8f4fcec45972a50131bd282' for checksum type 'sha512'. Consider passing the actual checksums through with --checksum --checksum64 once you validate the checksums are appropriate. A less secure option is to pass --ignore-checksums if necessary.
The install of FirefoxESR was NOT successful.
[...]

WHY it is happening:

For a few locales, the function that obtain the checksum from the LanguageChecksums.csv (GetChecksums) obtains the wrong checksum.

My example:

• my locale is "ca" (/l:ca) for catalan version.
• The match that performs the GetChecksums function is:

$checksum64 = ($checksumContent -match "$language\|64") -split '\|' | Select-Object -Last 1

• There are two matches from the file: Catalan and Canadian English.

ca|64|88d859...
en-CA|64|43d52b...

• The package downloads the correct file but matches against the wrong checksum

Same problem with these combinations:

• "fy-NL" and "nl" (in this case, the last match is the correct one)
• "ar" and "es-AR"
• "br" and "pt-BR"

Expected Behaviour

The installation process should find the correct checksum, validate the downloaded file and install the package.

Steps To Reproduce

You can force this error using the "/l:ca" argument:

choco install firefoxesr --params "/l:ca"

Environment

- Operating System: Windows 10 and 11

Chocolatey Log

2026-03-12 19:12:45,691 4932 [DEBUG] - ---------------------------Script Execution---------------------------
2026-03-12 19:12:45,691 4932 [DEBUG] - Running 'ChocolateyScriptRunner' for FirefoxESR v140.8.0 with packageScript 'C:\ProgramData\chocolatey\lib\FirefoxESR\tools\chocolateyInstall.ps1', packageFolder:'C:\ProgramData\chocolatey\lib\FirefoxESR', installArguments: '', packageParameters: '', preRunHookScripts: '', postRunHookScripts: '',
2026-03-12 19:12:45,701 4932 [DEBUG] - Running package script 'C:\ProgramData\chocolatey\lib\FirefoxESR\tools\chocolateyInstall.ps1'
2026-03-12 19:12:45,749 4932 [DEBUG] - Running Get-PackageParameters 
2026-03-12 19:12:45,749 4932 [DEBUG] - Parsing $env:ChocolateyPackageParameters and $env:ChocolateyPackageParametersSensitive for parameters
2026-03-12 19:12:45,813 4932 [DEBUG] - Running Get-OSArchitectureWidth -compare '64' 
2026-03-12 19:12:45,939 4932 [DEBUG] - 103 locales are stored.
ach af an ar ast az be bg bn br bs ca-valencia ca cak cs cy da de dsb el en-CA en-GB en-US eo es-AR es-CL es-ES es-MX et eu fa ff fi fr fur fy-NL ga-IE gd gl gn gu-IN he hi-IN hr hsb hu hy-AM ia id is it ja ka kab kk km kn ko lij lt lv mk mr ms my nb-NO ne-NP nl nn-NO oc pa-IN pl pt-BR pt-PT rm ro ru sat sc sco si sk skr sl son sq sr sv-SE szl ta te tg th tl tr trs uk ur uz vi xh zh-CN zh-TW
2026-03-12 19:12:45,939 4932 [DEBUG] - Running Get-PackageParameters 
2026-03-12 19:12:45,939 4932 [DEBUG] - Parsing $env:ChocolateyPackageParameters and $env:ChocolateyPackageParametersSensitive for parameters
2026-03-12 19:12:45,958 4932 [INFO ] - VERBOSE: Installed locale is: ''...
2026-03-12 19:12:45,968 4932 [INFO ] - VERBOSE: Absolute Fallback locale is: 'en-US'...
2026-03-12 19:12:45,968 4932 [DEBUG] - Testing locale  of whether we have the information or not
2026-03-12 19:12:45,982 4932 [DEBUG] - Testing locale  of whether we have the information or not
2026-03-12 19:12:45,984 4932 [DEBUG] - Testing locale  of whether we have the information or not
2026-03-12 19:12:45,987 4932 [DEBUG] - Testing locale ca-ES of whether we have the information or not
2026-03-12 19:12:45,987 4932 [DEBUG] - Testing locale CAT of whether we have the information or not
2026-03-12 19:12:45,991 4932 [DEBUG] - Testing locale ca of whether we have the information or not
2026-03-12 19:12:45,991 4932 [INFO ] - Using locale 'ca'...
2026-03-12 19:12:45,991 4932 [DEBUG] - Loading checksums from: C:\ProgramData\chocolatey\lib\FirefoxESR\tools\LanguageChecksums.csv
2026-03-12 19:12:45,991 4932 [DEBUG] - Running Get-OSArchitectureWidth -compare '64' 
2026-03-12 19:12:46,005 4932 [DEBUG] - Running Get-OSArchitectureWidth -compare '64' 
2026-03-12 19:12:46,035 4932 [DEBUG] - Running Install-ChocolateyPackage -silentArgs ' /PreventRebootRequired=true /RemoveDistributionDir=false /S' -checksum64 'a866522efc851fc37b7719881de7a8818f4591e13a69418bda9dec39cc58a9e6ee18f47cd35cf154964c2a27af8e4e2b0cdabf38a8f4fcec45972a50131bd282' -checksumType 'sha512' -url 'https://download.mozilla.org/?product=firefox-140.8.0esr-ssl&os=win&lang=ca' -checksum 'ab78809010a5f1410cbbaf7fc36351dbcd6b932c7ebd58da822996cc887a1be3b850c1a01ee0979f3b7f85efd7c05ad5c2f3de38b6f25ba85f8fcc904c4673fb' -checksumType64 'sha512' -url64bit 'https://download.mozilla.org/?product=firefox-140.8.0esr-ssl&os=win64&lang=ca' -packageName 'FirefoxESR' -validExitCodes '0' -fileType 'exe' 
2026-03-12 19:12:46,058 4932 [DEBUG] - Running Get-ChocolateyWebFile -packageName 'FirefoxESR' -fileFullPath 'C:\Users\it\AppData\Local\Temp\chocolatey\FirefoxESR\140.8.0\FirefoxESRInstall.exe' -url 'https://download.mozilla.org/?product=firefox-140.8.0esr-ssl&os=win&lang=ca' -url64bit 'https://download.mozilla.org/?product=firefox-140.8.0esr-ssl&os=win64&lang=ca' -checksum 'ab78809010a5f1410cbbaf7fc36351dbcd6b932c7ebd58da822996cc887a1be3b850c1a01ee0979f3b7f85efd7c05ad5c2f3de38b6f25ba85f8fcc904c4673fb' -checksumType 'sha512' -checksum64 'a866522efc851fc37b7719881de7a8818f4591e13a69418bda9dec39cc58a9e6ee18f47cd35cf154964c2a27af8e4e2b0cdabf38a8f4fcec45972a50131bd282' -checksumType64 'sha512' -options 'System.Collections.Hashtable' -getOriginalFileName 'True' 
2026-03-12 19:12:46,068 4932 [DEBUG] - Running Get-OSArchitectureWidth -compare '64' 
2026-03-12 19:12:46,068 4932 [DEBUG] - CPU is 64 bit
2026-03-12 19:12:46,068 4932 [DEBUG] - Setting url to 'https://download.mozilla.org/?product=firefox-140.8.0esr-ssl&os=win64&lang=ca' and bitPackage to 64
2026-03-12 19:12:46,082 4932 [DEBUG] - Running Get-WebFileName -url 'https://download.mozilla.org/?product=firefox-140.8.0esr-ssl&os=win64&lang=ca' -defaultName 'FirefoxESRInstall.exe' 
2026-03-12 19:12:46,434 4932 [DEBUG] - Using response url to determine file name. 'https://download-installer.cdn.mozilla.net/pub/firefox/releases/140.8.0esr/win64/ca/Firefox Setup 140.8.0esr.exe'
2026-03-12 19:12:46,434 4932 [DEBUG] - File name determined from url is 'Firefox Setup 140.8.0esr.exe'
2026-03-12 19:12:46,440 4932 [DEBUG] - Running Get-WebHeaders -url 'https://download.mozilla.org/?product=firefox-140.8.0esr-ssl&os=win64&lang=ca' -ErrorAction 'Stop' 
2026-03-12 19:12:46,440 4932 [DEBUG] - Setting the UserAgent to 'chocolatey command line'
2026-03-12 19:12:46,440 4932 [DEBUG] - Request Headers:
2026-03-12 19:12:46,440 4932 [DEBUG] -   'Accept':'*/*'
2026-03-12 19:12:46,440 4932 [DEBUG] -   'User-Agent':'chocolatey command line'
2026-03-12 19:12:46,662 4932 [DEBUG] - Response Headers:
2026-03-12 19:12:46,662 4932 [DEBUG] -   'Connection':'keep-alive'
2026-03-12 19:12:46,672 4932 [DEBUG] -   'x-guploader-uploadid':'AGQBYWwhi5icz8DJsvAHnF_kGxXbFVXWwlCWKCTfGU0_yLIrXHUfYq5KI4hBEwKhixOQecS3OHk_Tb0'
2026-03-12 19:12:46,672 4932 [DEBUG] -   'x-goog-hash':'crc32c=mAdo7g==,md5=Upm7amUI/eSCfnzPEWssEA=='
2026-03-12 19:12:46,672 4932 [DEBUG] -   'strict-transport-security':'max-age=31536000'
2026-03-12 19:12:46,672 4932 [DEBUG] -   'x-goog-storage-class':'STANDARD'
2026-03-12 19:12:46,672 4932 [DEBUG] -   'Age':'910663'
2026-03-12 19:12:46,672 4932 [DEBUG] -   'X-Served-By':'cache-bfi-kbfi7400029-BFI, cache-bfi-kbfi7400079-BFI, cache-toj-leto2350033-TOJ'
2026-03-12 19:12:46,672 4932 [DEBUG] -   'X-Cache':'MISS, HIT, HIT'
2026-03-12 19:12:46,676 4932 [DEBUG] -   'X-Cache-Hits':'0, 10, 1'
2026-03-12 19:12:46,676 4932 [DEBUG] -   'X-Timer':'S1773339047.327565,VS0,VE22'
2026-03-12 19:12:46,676 4932 [DEBUG] -   'Vary':'Origin'
2026-03-12 19:12:46,676 4932 [DEBUG] -   'Accept-Ranges':'bytes'
2026-03-12 19:12:46,676 4932 [DEBUG] -   'Content-Length':'73673696'
2026-03-12 19:12:46,676 4932 [DEBUG] -   'Cache-Control':'max-age=15552000'
2026-03-12 19:12:46,676 4932 [DEBUG] -   'Content-Type':'application/x-msdos-program'
2026-03-12 19:12:46,676 4932 [DEBUG] -   'Date':'Thu, 12 Mar 2026 18:10:47 GMT'
2026-03-12 19:12:46,676 4932 [DEBUG] -   'Expires':'Sat, 29 Aug 2026 05:13:03 GMT'
2026-03-12 19:12:46,676 4932 [DEBUG] -   'ETag':'"5299bb6a6508fde4827e7ccf116b2c10"'
2026-03-12 19:12:46,676 4932 [DEBUG] -   'Last-Modified':'Mon, 23 Feb 2026 14:23:45 GMT'
2026-03-12 19:12:46,676 4932 [DEBUG] -   'Server':'nginx'
2026-03-12 19:12:46,676 4932 [DEBUG] -   'Via':'1.1 google, 1.1 varnish, 1.1 varnish, 1.1 varnish'
2026-03-12 19:12:46,676 4932 [INFO ] - Downloading FirefoxESR 64 bit
  from 'https://download.mozilla.org/?product=firefox-140.8.0esr-ssl&os=win64&lang=ca'
2026-03-12 19:12:46,692 4932 [DEBUG] - Running Get-WebFile -url 'https://download.mozilla.org/?product=firefox-140.8.0esr-ssl&os=win64&lang=ca' -fileName 'C:\Users\it\AppData\Local\Temp\chocolatey\FirefoxESR\140.8.0\Firefox Setup 140.8.0esr.exe' -options 'System.Collections.Hashtable' 
2026-03-12 19:12:46,695 4932 [DEBUG] - Setting request timeout to  30000
2026-03-12 19:12:46,695 4932 [DEBUG] - Setting read/write timeout to  2700000
2026-03-12 19:12:46,695 4932 [DEBUG] - Setting the UserAgent to 'chocolatey command line'
2026-03-12 19:12:46,966 4932 [DEBUG] - Downloading https://download.mozilla.org/?product=firefox-140.8.0esr-ssl&os=win64&lang=ca to C:\Users\it\AppData\Local\Temp\chocolatey\FirefoxESR\140.8.0\Firefox Setup 140.8.0esr.exe
2026-03-12 19:12:53,240 4932 [INFO ] - 
2026-03-12 19:12:53,240 4932 [INFO ] - Download of Firefox Setup 140.8.0esr.exe (70.26 MB) completed.
2026-03-12 19:12:56,254 4932 [DEBUG] - No runtime virus checking built into FOSS Chocolatey. Check out Pro/Business - https://chocolatey.org/compare
2026-03-12 19:12:56,262 4932 [DEBUG] - Verifying package provided checksum of 'a866522efc851fc37b7719881de7a8818f4591e13a69418bda9dec39cc58a9e6ee18f47cd35cf154964c2a27af8e4e2b0cdabf38a8f4fcec45972a50131bd282' for 'C:\Users\it\AppData\Local\Temp\chocolatey\FirefoxESR\140.8.0\Firefox Setup 140.8.0esr.exe'.
2026-03-12 19:12:56,262 4932 [DEBUG] - Running Get-ChecksumValid -file 'C:\Users\it\AppData\Local\Temp\chocolatey\FirefoxESR\140.8.0\Firefox Setup 140.8.0esr.exe' -checksum 'a866522efc851fc37b7719881de7a8818f4591e13a69418bda9dec39cc58a9e6ee18f47cd35cf154964c2a27af8e4e2b0cdabf38a8f4fcec45972a50131bd282' -checksumType 'sha512' -originalUrl 'https://download.mozilla.org/?product=firefox-140.8.0esr-ssl&os=win64&lang=ca' 
2026-03-12 19:12:56,262 4932 [DEBUG] - checksum.exe found at 'C:\ProgramData\chocolatey\helpers\..\tools\checksum.exe'
2026-03-12 19:12:56,262 4932 [DEBUG] - Executing command ['C:\ProgramData\chocolatey\helpers\..\tools\checksum.exe' -c="a866522efc851fc37b7719881de7a8818f4591e13a69418bda9dec39cc58a9e6ee18f47cd35cf154964c2a27af8e4e2b0cdabf38a8f4fcec45972a50131bd282" -t="sha512" -f="C:\Users\it\AppData\Local\Temp\chocolatey\FirefoxESR\140.8.0\Firefox Setup 140.8.0esr.exe"]
2026-03-12 19:12:56,702 4932 [DEBUG] - Command ['C:\ProgramData\chocolatey\helpers\..\tools\checksum.exe' -c="a866522efc851fc37b7719881de7a8818f4591e13a69418bda9dec39cc58a9e6ee18f47cd35cf154964c2a27af8e4e2b0cdabf38a8f4fcec45972a50131bd282" -t="sha512" -f="C:\Users\it\AppData\Local\Temp\chocolatey\FirefoxESR\140.8.0\Firefox Setup 140.8.0esr.exe"] exited with '1'.
2026-03-12 19:12:56,702 4932 [ERROR] - ERROR: Checksum for 'C:\Users\it\AppData\Local\Temp\chocolatey\FirefoxESR\140.8.0\Firefox Setup 140.8.0esr.exe' did not meet 'a866522efc851fc37b7719881de7a8818f4591e13a69418bda9dec39cc58a9e6ee18f47cd35cf154964c2a27af8e4e2b0cdabf38a8f4fcec45972a50131bd282' for checksum type 'sha512'. Consider passing the actual checksums through with --checksum --checksum64 once you validate the checksums are appropriate. A less secure option is to pass --ignore-checksums if necessary.

Anything else?

The solution could be to match the complete string using the anchor ^ (line start):

$checksum64 = ($checksumContent -match "^$language\|64") -split '\|' | Select-Object -Last 1

[github-actions]

Thanks for raising this issue!

The packages within this repository are maintained by a small team of volunteer Community Maintainers, in their own time. Their time, like yours is important. Please help them by not wasting it.

This is a community repository where the expectation is that everybody will get involved by raising pull requests to fix problems they find. This will also allow that problem to be fixed more quickly as you don't have to wait for a member of the Community Maintainer Team to pick it up.

If you are unable to fix the issue yourself, the Community Maintainers Team will look at it when time allows. There are no service level agreements, nor should there be any expectation on when people can resolve issues in their own time.

A few dos and don'ts:

• Do provide as much information as you can in any issue that you raise.
• Don't complain that an issue has not yet been picked up or resolved. You are expected to help out in this community maintained repository. If you are unable to do so, don't complain when others don't adhere to your timelines. There is no SLA nor should you have any expectation of one.
• Do read the CONTRIBUTING and COMMITTERS documentation before raising a pull request as it contains valuable information on what automation is used in this repository.
• Do read the Code of Conduct.
• Don't post your frustration in comments. The Community Maintainers Team are not a punching bag for your frustration. You will only end up banned from the repository.

Thank you.
(Automatically posted message)

[github-actions]

Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?
This issue will be closed in 14 days if it continues to be inactive.

Please do not add a comment to circumvent automatic closure unless you plan to help move it forward.
Doing this may lead to the issue being closed immediately instead.

[github-actions]

Dear contributor,

As this issue seems to have been inactive for quite some time now, I've automatically closed it.
If you feel this is a valid issue, please feel free to re-open the issue if/when a pull request
has been added.
Thank you for your contribution.