🐛 cloudflared 2026.5.0 darwin tgz checksums do not match release assets

[redbg]

Description

The SHA256 checksums listed in the 2026.5.0 release body do not match the actual GitHub release asset digests for the macOS .tgz artifacts.

Release:
https://github.com/cloudflare/cloudflared/releases/tag/2026.5.0

Affected assets:

cloudflared-darwin-amd64.tgz
  release body: 2b9ad49aee5d390ba9b9bf949a0576cc1e5f1e7444a59f4db0f0ceff05560542
  asset digest:  7f2c4c8c86e787226804694112682aefacd4cfb98f54508f1a5a841a78bbbef9

cloudflared-darwin-arm64.tgz
  release body: 2c1664a06fb7bc4d3af24e208ee34a1b5ed4610006dab98aa3e65cccf2c6b444
  asset digest:  116ef11a59fc4f31e7f1bcc4378070cd7ca053fa37b4484b1432bb150b358219

[redbg]

➜ Local: http://localhost:3000/
➜ Network: use --host to expose
➜ Debug: http://localhost:3000/__debug
➜ press b + enter to list configured Cloudflare bindings
➜ press e + enter to open local explorer
➜ press t + enter to start tunnel
➜ press h + enter to show help
o
t

➜ Starting tunnel (usually takes a few seconds)...

 Once connected, this tunnel will be publicly accessible. Anyone who can reach it can:
 • Call ungated endpoints
 • Trigger logic that uses remote bindings
 • Reach internal services if your Worker proxies requests
 • Request module source and other dev-server assets
 • Access HMR messages, including absolute file system paths
 • Observe file-change cadence and parts of the live module graph
 
 If you only need to share a running build, use vite preview to avoid HMR and other dev-server exposure.
 Consider using a named tunnel with Cloudflare Access to restrict access.
 
 Press t + enter again to close the tunnel.

Downloading cloudflared 2026.5.1...
Error: [cloudflared] SHA256 mismatch for downloaded cloudflared tarball.

Expected: 086dd6628a3608eba7327af1092abcc52b10994524112ae49bf356ec49bef8c4
Actual: af75f2fa11a42de1ceaa0345537c51d3c86915748e65bc2c6680983dfd36ae74

[jcsf]

Hi,
Are you running cloudflare tunnel using wrangler or using cloudflared directly?
The reason the hashes don't match is because the hash we publish is the hash of the binary inside the tar.gz not the bundle hash. This is used by the auto-updater system of cloudflared, but wrangler has its own updating system, so it can have a miss-alignment there.

[nikitacano]

Fix for wrangler: cloudflare/workers-sdk#14111.