azure-firewall extension 2.2.1 fails to install: checksum does not match the expected value

[mkozikowsk]

Describe the bug

Installing the azure-firewall CLI extension version 2.2.1 fails with a checksum
mismatch. The sha256Digest recorded in the extension index does not match the
SHA-256 of the actual .whl published in blob storage, so az extension add aborts.

Version 2.2.0 installs correctly, so this is specific to the 2.2.1 release
artifact/index entry.

Related command

az extension add --name azure-firewall --version 2.2.1

Errors

ERROR: The checksum of the extension does not match the expected value. Use --debug for more information.

Issue script & Debug output

DEBUG: cli.azure.cli.core.extension._resolve: Chosen {'downloadUrl': 'https://azcliprod.blob.core.windows.net/cli-extensions/azure_firewall-2.2.1-py2.py3-none-any.whl', ... 'version': '2.2.1'}, 'sha256Digest': '1ff948c19b1579a0ee650595fb261cf7ac281a3dd60e461a501db942228e6f58'}
DEBUG: cli.azure.cli.core.extension.operations: Invalid checksum for ...\azure_firewall-2.2.1-py2.py3-none-any.whl. Expected '1ff948c19b1579a0ee650595fb261cf7ac281a3dd60e461a501db942228e6f58', computed 'ab86a2d1412ba8a23dec0f0e678fc992e4f540b38a6b7eab6193c8b62bb5afdb'.
knack.util.CLIError: The checksum of the extension does not match the expected value. Use --debug for more information.

Details:

• Download URL: https://azcliprod.blob.core.windows.net/cli-extensions/azure_firewall-2.2.1-py2.py3-none-any.whl
• Expected SHA-256 (from extension index): 1ff948c19b1579a0ee650595fb261cf7ac281a3dd60e461a501db942228e6f58
• Computed SHA-256 (of downloaded file): ab86a2d1412ba8a23dec0f0e678fc992e4f540b38a6b7eab6193c8b62bb5afdb

The mismatch indicates the published .whl and the index entry are out of sync
(the blob was likely re-uploaded without updating the index sha256Digest, or vice versa).

Expected behavior

az extension add --name azure-firewall --version 2.2.1 installs successfully,
i.e. the index sha256Digest matches the SHA-256 of the published .whl.

Environment Summary

{
"azure-cli": "2.88.0",
"azure-cli-core": "2.88.0",
"azure-cli-telemetry": "1.1.0",
"extensions": {
"azure-devops": "1.0.5",
"storage-preview": "1.0.0b8"
}
}

Additional context

No response

[azure-client-tools-bot-prd]

Hi @mkozikowsk,

2.78.0 is not the latest Azure CLI(2.88.0).

If you haven't already attempted to do so, please upgrade to the latest Azure CLI version by following https://learn.microsoft.com/en-us/cli/azure/update-azure-cli.

[yonzhan]

Thank you for opening this issue, we will look into it.

[azure-client-tools-agent]

Routed to Azure/azure-cli-extensions as #10112 (Azure/azure-cli-extensions#10112) because this targets the azure-firewall extension, whose source lives in Azure/azure-cli-extensions.

---

Posted by agent-assist (autonomous bug-fix pipeline).

[saisharan0103]

The debug output narrows this to the azure-firewall 2.2.1 extension index entry: it advertises sha256Digest 1ff948c19b1579a0ee650595fb261cf7ac281a3dd60e461a501db942228e6f58, while the downloaded wheel hashes to ab86a2d1412ba8a23dec0f0e678fc992e4f540b38a6b7eab6193c8b62bb5afdb.

If this needs a PR, I would start by aligning the 2.2.1 artifact/index metadata, then add a focused extension install/index validation test for a pinned version with mismatched checksum metadata.

[necusjz]

@saisharan0103 it's fixed, please try again after a while.