I’m seeing a checksum mismatch during zypper dup on openSUSE Leap 16.0 (WSL2).
Repository
openSUSE:repo-oss repo-oss (16.0)
http://cdn.opensuse.org/distribution/leap/16.0/repo/oss/x86_64
Affected package
aaa_base-84.87+git20260602.e901e17e-160000.1.1.x86_64.rpm
zypper reports
Expected SHA512:87182705b4201759733e4dbb2b7940f8…
Downloaded RPM SHA512:9ab7e4f93ebe09a38498a999fb2706d3…
I checked the locally cached repository metadata (primary.xml.zst),
and it indeed contains the expected checksum 87182705… for aaa_base-84.87+git20260602.e901e17e.
However, the downloaded RPM consistently has checksum 9ab7e4f9…
I reproduced this on four separate Leap 16.0 WSL installations.
zypper verify reports no dependency issues, and rpm -V aaa_base aaa_base-extras aaa_base-wsl reports no local corruption.
I also checked the current Tumbleweed metadata for the same upstream version, and its checksum is different and appears consistent.
The mismatch seems specific to the Leap 16.0 release 160000.1.1 package.
Has anyone else seen this on Leap 16.0 (WSL or non-WSL systems)?
Could this be a repository metadata/package synchronization issue?