Bug: Firefox DMGs have different hashes on every download of the same Firefox DMG (macOS)
Status: RESOLVED
Priority: --
Resolution: INVALID
Created: 2024-04-20 19:43:02+00:00
Resolved: 2024-04-21 11:54:01+00:00

Steps to reproduce:

I downloaded Firefox 125.0.1 using the "Download Firefox" link from https://www.mozilla.org/en-US/firefox/new/
using Firefox 115.10.0esr on macOS Big Sur 11.7.10


Actual results:

On every single download of Firefox 125.0.1, I got a downloaded file "Firefox 125.0.1.dmg" with a different hash.

More details:
I tried 4 different times and this is what happened:
1. Download 1 - the redirected download URL was:
https://cdn.stubdownloader.services.mozilla.com/builds/firefox-latest-ssl/en-US/osx/d0522efca2afe8a17d30a07d857c4e9ee1d3fb13ac4ff3b254f52f86f60069f6/Firefox%20125.0.1.dmg
and the sha256 hash was:
2000fc764eb6790d719557b8b3ca1a70b75e2294d1d63a62cc85f19ad2ab454a
(virustotal link: https://www.virustotal.com/gui/file/2000fc764eb6790d719557b8b3ca1a70b75e2294d1d63a62cc85f19ad2ab454a)

2. Download 2 - the redirected download URL was:
https://cdn.stubdownloader.services.mozilla.com/builds/firefox-latest-ssl/en-US/osx/76d20c04aada26c846d691122e0d27b39ad472f81e08abaa7f1da114c8488035/Firefox%20125.0.1.dmg
and the sha256 hash was:
50415BFA0CA22018D1816A1EF4E3F8CD0299D8F33F8452DADE213F65FC2426D4

3. Download 3 - the redirected download URL was:
https://cdn.stubdownloader.services.mozilla.com/builds/firefox-latest-ssl/en-US/osx/6a86503733c8bf37e69a39389281535494204852d20afa5970635ed7304ca165/Firefox%20125.0.1.dmg
and the sha256 hash was:
95594D330151847922CA9689CD9A4E1C6B3A97A11EF651F021EDD3924731C4D6

4. Download 4 - the redirected download URL was:
https://cdn.stubdownloader.services.mozilla.com/builds/firefox-latest-ssl/en-US/osx/15c5481950f2cfde7566583e86873b4cdd895eea3c21bf99085381f28e4307b2/Firefox%20125.0.1.dmg
and the sha256 hash was:
CBE2B64398D50EAC2F4CBE0EA4B50CE316A027EED2D79A00BDF49AE93F4150C1

I've looked at the contents of each DMG and they appear identical, I even ran the "mtree" terminal command to see exactly what is in each mounted DMG volume and I saw no differences between them, they are all identical and also identical the the canonical ftp download of Firefox from https://ftp.mozilla.org/pub/firefox/releases/125.0.1/mac/en-US/Firefox%20125.0.1.dmg

I have attached the mtree report

mtree commands used:
1. to create the mtree report:
mtree -c -K sha256digest -p /Volumes/Firefox > ~/Desktop/FirefoxDMG.mtree
2. to compare the different DMG mounted volumes to the report (no terminal output means the report matches the mounted volume):
mtree -p /Volumes/Firefox < ~/Desktop/FirefoxDMG.mtree



Expected results:

The hash of each download should have been the same, that is 3F431079D423E5397987A4120A63948217252426219F23348CB6B6BBDED3ACF3 for the en-US version of "Firefox 125.0.1.dmg" as can be seen in the official list of hashes here: https://ftp.mozilla.org/pub/firefox/releases/125.0.1/SHA256SUMS

I had no issue downloading the Firefox DMG directly from the ftp page here: https://ftp.mozilla.org/pub/firefox/releases/125.0.1/mac/en-US/

I also tried downloading Firefox from another Mac computer but this time using Firefox 125.0.1 itself to download the DMG from https://www.mozilla.org/en-US/firefox/new/ and this time I got the expect hash on the DMG download (this time the redirected download URL was a non-unique one, https://download-installer.cdn.mozilla.net/pub/firefox/releases/125.0.1/mac/en-US/Firefox%20125.0.1.dmg )

So it seems that when the unique redirected URLs are used for a download (I don't know what triggered it on the first Mac and not the second) that the DMG hashes don't match, although their contents appear identical (how is that possible?) I can upload the DMGs if requested, but downloading from the unique redirect URLs specified above should produce the same output I got (I tried redownloading from them and got the same DMGs on subsequent downloads)