SHA256 checksums of downloaded archive is different each time

Feedback & Bug Reports Product Feedback
1

Hello,

We’re using this repo/commit below to get arm toolchain archives in a bazel build.

https://github.com/hexdae/toolchains_arm_gnu/blob/0a42ae55bbf08b1019a8f3b0092a3a90d44647b6/deps.bzl#L17

`{
    "name": "arm_none_eabi_linux_x86_64",
    "sha256": "bcd840f839d5bf49279638e9f67890b2ef3a7c9c7a9b25271e83ec4ff41d177a",
    "build_file": "@arm_none_eabi//toolchain:compiler/nix.BUILD",
    "strip_prefix": "gcc-arm-none-eabi-9-2019-q4-major",
    "url": "``https://developer.arm.com/-/media/Files/downloads/gnu-rm/9-2019q4/gcc-arm-none-eabi-9-2019-q4-major-x86_64-linux.tar.bz2?revision=108bd959-44bd-4619-9c19-26187abf5225&la=en&hash=E788CE92E5DFD64B2A8C246BBA91A249CB8E2D2D``",
},`

Each time our build runs, this repo pulls archives from the arm website, and checks their SHA256. The build fails if the SHA256 does not match the expected. Each run, the checksum is different (and different in a different way then the previous build attempt) on circleci, and the build fails. See run examples below.

This works fine locally, and if I download the archive from the website, it has the expected checksum.

sha256sum gcc-arm-none-eabi-9-2019-q4-major-x86_64-linux.tar.bz2
bcd840f839d5bf49279638e9f67890b2ef3a7c9c7a9b25271e83ec4ff41d177a gcc-arm-none-eabi-9-2019-q4-major-x86_64-linux.tar.bz2

This started happening between our nightly build at November 25th, 2025 at 09:36:35 UTC and a tiny unrelated commit at November 25th, 2025 at 20:13:48 UTC.

Thank you to anyone who can help!

One run (some particulars omitted with …):
ERROR: /home/circleci/project/… depends on @arm_none_eabi_linux_x86_64//:objcopy in repository @arm_none_eabi_linux_x86_64 which failed to fetch. no such package ‘@arm_none_eabi_linux_x86_64//’: java.io.IOException: Error downloading [``https://developer.arm.com/-/media/Files/downloads/gnu-rm/9-2019q4/gcc-arm-none-eabi-9-2019-q4-major-x86_64-linux.tar.bz2?revision=108bd959-44bd-4619-9c19-26187abf5225&la=en&hash=E788CE92E5DFD64B2A8C246BBA91A249CB8E2D2D``] to /home/circleci/.cache/bazel/_bazel_circleci/…/external/arm_none_eabi_linux_x86_64/…/gcc-arm-none-eabi-9-2019-q4-major-x86_64-linux.tar.bz2: Checksum was 12d3dd883f550ecc56f4234fe30108ea0c9865cea4d1c27e768f9008a45f5189 but wanted bcd840f839d5bf49279638e9f67890b2ef3a7c9c7a9b25271e83ec4ff41d177a

Re-run:
ERROR: /home/circleci/project/… depends on @arm_none_eabi_linux_x86_64//:objcopy in repository @arm_none_eabi_linux_x86_64 which failed to fetch. no such package ‘@arm_none_eabi_linux_x86_64//’: java.io.IOException: Error downloading [``https://developer.arm.com/-/media/Files/downloads/gnu-rm/9-2019q4/gcc-arm-none-eabi-9-2019-q4-major-x86_64-linux.tar.bz2?revision=108bd959-44bd-4619-9c19-26187abf5225&la=en&hash=E788CE92E5DFD64B2A8C246BBA91A249CB8E2D2D``] to /home/circleci/.cache/bazel/_bazel_circleci/…/external/arm_none_eabi_linux_x86_64/…/gcc-arm-none-eabi-9-2019-q4-major-x86_64-linux.tar.bz2: Checksum was 544bea236e23b94359da8b63ecd032d7ec179323ebe731acc9bcdd4786eebcec but wanted bcd840f839d5bf49279638e9f67890b2ef3a7c9c7a9b25271e83ec4ff41d177a

3

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.