Nodejs 15: ICU 68.1 tarball doesn't match provided md5sum

[sgallagher]

• Version: 15.5.0
• Platform: All (tarball contents)
• Subsystem: Build

What steps will reproduce the bug?

• Download ICU 68.1 from https://github.com/unicode-org/icu/releases/download/release-68-1/icu4c-68_1-src.tgz as specified in https://github.com/nodejs/node/blob/v15.5.0/tools/icu/current_ver.dep
• Run md5sum icu4c-68_1-src.tgz
• Compare md5 from current_ver.dep to the results of the md5sum

Actual result: 6a99b541ea01f271257b121a4433c7c0 icu4c-68_1-src.tgz doesn't match fd03b2d916dcadd3711b4c4a100a1713

How often does it reproduce? Is there a required condition?

Reproduces successfully every time.

What is the expected behavior?

The md5sums need to match.

What do you see instead?

The md5sums differ, which means the tarball cannot be considered trusted.

Additional information

Someone needs to audit the ICU tarball and determine where the difference occurred.

[richardlau]

Looks like it might be a copy/paste error. https://github.com/unicode-org/icu/releases/download/release-68-1/icu-68_1-src.md5 lists:

6a99b541ea01f271257b121a4433c7c0  icu4c-68_1-src.tgz
fd03b2d916dcadd3711b4c4a100a1713  icu4c-68_1-src.zip

so it looks like the hash is for the zip version of the source. I've raised #36777 to correct.

[sgallagher]

Thanks! I have a script I use to assist with updating Node.js in Fedora and it choked while trying to verify the ICU integrity.