Task v3.45.5 Package Corrupted/Out of Sync on Cloudsmith APT Mirror

[sfwester]

Description

Summary

The Task v3.45.5 package on the Cloudsmith APT repository for Debian Bookworm is corrupted or out of sync. The repository metadata indicates one file size and checksum, but the actual file being served is significantly smaller and has a different checksum. This causes package installation to fail during Docker builds and other APT installations.

Issue Details

Repository Information

• Package: task v3.45.5
• Repository: task/task on Cloudsmith
• Distribution: Debian Bookworm (bookworm)
• Architecture: amd64

Expected vs Actual

Property	Expected (Metadata)	Actual (Served)
File Size	7,330,664 bytes	7,180,126 bytes
Size Difference	—	150,538 bytes shorter (~2.05%)
SHA256 Checksum	9b79e95bbb56c922d77a64aa095847cee0ce967f36dd5046554b77176aa2e295	b6725faf62ae793d147b70e203fca047c01920807376f9c54d2e9d4211314b81
MD5Sum	403366753146afdd561af08977233e7b	(Not verified, but likely differs)

Metadata Source

The expected file information comes from the official Cloudsmith repository metadata:

URL: https://dl.cloudsmith.io/public/task/task/deb/debian/dists/bookworm/main/binary-amd64/Packages.gz 

Package entry shows:

Package: task
Version: 3.45.5
Size: 7330664
SHA256: 9b79e95bbb56c922d77a64aa095847cee0ce967f36dd5046554b77176aa2e295
Filename: pool/any-version/main/t/ta/task_3.45.5/task_linux_amd64.deb 

Actual File Information

Downloading the actual file:

curl -sL 'https://dl.cloudsmith.io/public/task/task/deb/debian/pool/any-version/main/t/ta/task_3.45.5/task_linux_amd64.deb' | wc -c
# Output: 7180126

curl -sL 'https://dl.cloudsmith.io/public/task/task/deb/debian/pool/any-version/main/t/ta/task_3.45.5/task_linux_amd64.deb' | sha256sum
# Output: b6725faf62ae793d147b70e203fca047c01920807376f9c54d2e9d4211314b81 

Error Output

When attempting to install via APT:

E: Failed to fetch https://dl.cloudsmith.io/public/task/task/deb/debian/pool/any-version/main/t/ta/task_3.45.5/task_linux_amd64.deb
  File has unexpected size (7180126 != 7330664). Mirror sync in progress? [IP: 18.238.49.81 443]
  Hashes of expected file:
   - SHA256:9b79e95bbb56c922d77a64aa095847cee0ce967f36dd5046554b77176aa2e295
   - SHA1:59a3cd20ae9419a79ef36ae5d1c7895ef03d3432 [weak]
   - MD5Sum:403366753146afdd561af08977233e7b [weak]
   - Filesize:7330664 [weak]
E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing? 

Impact

This issue breaks Docker builds and any APT-based installations that target Task v3.45.5 from the Cloudsmith repository. The error occurs during the APT package verification step, which is expected behavior for security reasons.

Affected Use Case

Docker Dockerfile installation:

RUN curl -1sLf 'https://dl.cloudsmith.io/public/task/task/setup.deb.sh' | bash \
    && apt-get update -yq \
    && apt-get install -yq --no-install-recommends task=3.45.5 \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/* 

This fails with exit code 100 during the Docker build process.

Root Cause Analysis

The metadata in the Cloudsmith repository (last updated November 11, 2025) is out of sync with the actual file on the mirror. Possible causes:

1. Incomplete upload: The file upload to Cloudsmith was truncated or failed partway through
2. Repository metadata not refreshed: The index/Packages file wasn't updated after an upload failure
3. CDN cache mismatch: Different mirrors in the CDN may be serving different versions
4. File corruption: The stored file may have become corrupted

Reproduction Steps

1. Extract and verify the metadata from the Cloudsmith repository:curl -sL 'https://dl.cloudsmith.io/public/task/task/deb/debian/dists/bookworm/main/binary-amd64/Packages.gz' | gunzip | grep -A 15 "Version: 3.45.5"
2. Download the actual file and check its size:curl -sI 'https://dl.cloudsmith.io/public/task/task/deb/debian/pool/any-version/main/t/ta/task_3.45.5/task_linux_amd64.deb' | grep -i content-length
3. Verify the mismatch:
   • Expected: 7,330,664 bytes
   • Actual: 7,180,126 bytes

Consider...

This may just be a Cloudsmith infrastructure issue. The v3.45.5 release itself is correct and available on GitHub releases. The problem is with the Cloudsmith package mirror that Task uses for APT distributions.

You may want to:

1. Contact Cloudsmith support to expedite resolution
2. Consider verifying automated tests for package distribution availability

Version

3.45.5

Operating system

Debian Bookworm

Experiments Enabled

No response

Example Taskfile

[vmaerten]

Hello!
I posted a discussion on goreleaser : https://github.com/orgs/goreleaser/discussions/6321