Package content verification failing.

We have seen increasingly common reports of packages failing checksum validation.

For example:

Warning: Digest verification failed for file 'libeverest-3.6.6-1.2.x86_64.rpm'
[/var/tmp/zypp.tmp/AP_0xhEjTB9/x86_64/libeverest-3.6.6-1.2.x86_64.rpm]

  expected 7e2c964c447902d9d366068e2e54624d243111d14ec0e9fce0713323128077060e040aeca5b7fa04bc86f5a1ef2a05383fa3a6daa301bbc609521a01191464d1
  but got  125c6a48e9f30bacc002cb8b6699c260b7c59ed4f7e07b60d950b81d225bf6a7880e7da4859559d37176884e8495587c727413a9d39f1263d0f92050a7eefba0

There seems to be "no rhyme or reason" but there are multiple reports of this in community channels such as discord #support for opensuse.

I'm not sure of the "cause", but a possible reason is that OBS is rebuilding a package which creates a new signature, but retains the same version. This then causes mirrorcache to believe the file exists (since it will return 200 on HEAD), but will fail to pass checksums because the mirror may have the older version of the package content that doesn't match the repomd.xml data.

The report names no source file, test, or entry point. Start by reproducing the checksum mismatch and tracing how OBS rebuilds, mirrorcache HEAD responses, and cached package content interact; done means rebuilt packages consistently match the checksum recorded in repomd.xml.