Repository navigation
Bug: fingerprint of downloader doesn't match docs (macos arm64) #8380
Description
Description:
i have downloaded the macos installer for arm64, and tried to verify the package authenticity. running the verify command, i get
$ pkgutil --check-signature aws-sam-cli-macos-arm64.pkg
Package "aws-sam-cli-macos-arm64.pkg":
Status: signed by a developer certificate issued by Apple for distribution
Notarization: trusted by the Apple notary service
Signed with a trusted timestamp on: 2025-10-21 22:19:14 +0000
Certificate Chain:
1. Developer ID Installer: AMZN Mobile LLC (94KV3E626L)
Expires: 2030-09-26 00:18:06 +0000
SHA256 Fingerprint:
5C 45 BE 63 FD 52 10 07 2D 66 56 77 5C A9 FF 25 91 6D 3F 01 F7 0E
9A 8A 05 F6 2D 62 B2 88 8D A9
------------------------------------------------------------------------
2. Developer ID Certification Authority
Expires: 2031-09-17 00:00:00 +0000
SHA256 Fingerprint:
F1 6C D3 C5 4C 7F 83 CE A4 BF 1A 3E 6A 08 19 C8 AA A8 E4 A1 52 8F
D1 44 71 5F 35 06 43 D2 DF 3A
------------------------------------------------------------------------
3. Apple Root CA
Expires: 2035-02-09 21:40:36 +0000
SHA256 Fingerprint:
B0 B1 73 0E CB C7 FF 45 05 14 2C 49 F1 29 5E 6E DA 6B CA ED 7E 2C
68 C5 BE 91 B5 A1 10 01 F0 24
in particular, the first fingerprint for AMZN Mobile LLC
5C 45 BE 63 FD 52 10 07 2D 66 56 77 5C A9 FF 25 91 6D 3F 01 F7 0E 9A 8A 05 F6 2D 62 B2 88 8D A9
does not match the one documented in the verifications instructions:
49 68 39 4A BA 83 3B F0 CC 5E 98 3B E7 C1 72 AC 85 97 65 18 B9 4C BA 34 62 BF E9 23 76 98 C5 DA
Steps to reproduce:
- download installer from
https://github.com/aws/aws-sam-cli/releases/latest/download/aws-sam-cli-macos-arm64.pkg - run
pkgutil --check-signature aws-sam-cli-macos-arm64.pkg - compare appropriate fingerprint from output to fingerprint documented on website
Additional environment details (Ex: Windows, Mac, Amazon Linux etc)
- OS: MacOS
Activity
reedham-aws commentedon Oct 30, 2025
I am able to reproduce this issue. Examining more.
reedham-aws commentedon Oct 31, 2025
It looks like the key was rotated automatically, but the documentation was not updated. I have raised this issue with the docs team and will leave this issue open until the documentation is changed. Thank you for bringing this to our attention!
valentin-krasontovitsch commentedon Oct 31, 2025
sure thing, and thanks for checking it out and raising it further.
out of curiosity, if it's not sensitive info - when was the key rotated? 😊
reedham-aws commentedon Nov 10, 2025
It was rotated 10/21.
valentin-krasontovitsch commentedon Nov 15, 2025
oh my. that's quite a while ago 😅
thanks for sharing!
jasonleongero commentedon Jan 30, 2026
Issue is still present as of the time of this writing.
reedham-aws commentedon Jan 30, 2026
Thank you for bumping this issue @jasonleongero. Recent turnover on the documentation team allowed this issue to get lost in the cracks, but I have now personally made the update to have the fingerprints match. I will update again when the documentation is published, it should be sometime today or Monday (2026-02-02).
reedham-aws commentedon Jan 31, 2026
The docs are updated on https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/reference-sam-cli-install-verify.html. I've verified myself but if @valentin-krasontovitsch or @jasonleongero wants to confirm as well that would be good. If not, I will resolve this issue sometime next week.
jasonleongero commentedon Jan 31, 2026
@reedham-aws thank you! I have verified that the update to the documentation is correct.
github-actions commentedon Feb 2, 2026
Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.