#1140160 debian-cd: identical .contents checksums across all live image variants (13.5.0 and weekly)

#1140160#5
Date:
2026-06-16 16:04:53 UTC
From:
To:
If the .contents sidecars are intended to be identical across
variants, please disregard.

In the SHA512SUMS for the amd64 live images, every per-variant
*.iso.contents file shares one identical checksum, although the
.iso and .packages files differ per variant as expected. This
suggests all variants' .contents sidecars carry identical content,
where I would expect per-image listings to differ.

Observed in two independent channels and on two dates:

1. Stable 13.5.0 live (released 2026-05-16, observed 2026-06-10):
   nine *.iso.contents lines share one SHA512.

2. Weekly live build, checked 2026-06-16 ~15:45 UTC
   (
cdimage.debian.org/cdimage/weekly-live-builds/amd64/iso-hybrid/SHA512SUMS):
   the *.iso.contents lines share checksum
   642c1fb618a7b686cee11f1c088c12bae9b95ac9954e5b8a932c7b207860f2a6a...
   (9 of 9 variants match; .iso and .packages checksums differ normally).

I have not inspected the .contents contents of the 13.5.0 live entries
themselves, so I am
reporting the checksum observation rather than asserting a cause for those,
but the weekly-live build showed for the following four file contents the
exact same amount of characters in Kate:

`
https://cdimage.debian.org/cdimage/weekly-live-builds/amd64/iso-hybrid/debian-live-testing-amd64-kde.iso.contents`
`
https://cdimage.debian.org/cdimage/weekly-live-builds/amd64/iso-hybrid/debian-live-testing-amd64-standard.iso.contents`
`
https://cdimage.debian.org/cdimage/weekly-live-builds/amd64/iso-hybrid/debian-live-testing-amd64-xfce.iso.contents`
`
https://cdimage.debian.org/cdimage/weekly-live-builds/amd64/iso-hybrid/debian-live-testing-amd64-lxde.iso.contents`

Verified SHA512SUMS.sign against the Debian CD signing keys before
reporting, so this is a property of the signed build output, not a
transit/mirror artifact.

Kind regards.