wrong sha256sum or code injection

[waliwdenko]

Hello,

during install openssh-client i've got error:

Installing openssh-client (9.9_p1-r1) to root...
Downloading https://downloads.openwrt.org/releases/24.10.0/packages/mipsel_24kc/packages/openssh-client_9.9_p1-r1_mipsel_24kc.ipk
Collected errors:

• opkg_install_pkg: Checksum or size mismatch for package openssh-client. Either the opkg or the package index are corrupt. Try 'opkg update'.
• opkg_install_cmd: Cannot install package openssh-client.

I've downloaded file openssh-client_9.9_p1-r1_mipsel_24kc.ipk manually and checked sha256sum:

0f1145c3515df89f438a2acb1792e193c2da1cb47422924c8fb4a734ac642e41 openssh-client_9.9_p1-r1_mipsel_24kc.ipk

but in https://downloads.openwrt.org/releases/24.10.0/packages/mipsel_24kc/packages/Packages.gz i found this:

Package: openssh-client
Version: 9.9_p1-r1
Depends: libc, libopenssl3, zlib
Alternatives: 200:/usr/bin/ssh:/usr/libexec/ssh-openssh, 200:/usr/bin/scp:/usr/libexec/scp-openssh
License: BSD ISC
Section: net
URL: https://www.openssh.com/
CPE-ID: cpe:/a:openssh:openssh
Architecture: mipsel_24kc
Installed-Size: 1003520
Filename: openssh-client_9.9_p1-r1_mipsel_24kc.ipk
Size: 434745
SHA256sum: b9daf1b3e7b300a7a385b2500f616e6406f3e206ef1d02e38cd2ced98e381b99
Description: OpenSSH client.

check sums are differrent, someone forgot update package list or someone replace package? 😟

[brada4]

Whole directory alongside signed index s replaced at once including other file conteny changing maintaining same name.
eg
openwrt/asu@96b9e20