Support

That was a temporary issue which has been solved months ago. The CDN was serving an older update file, I invalidated the CDN cache, and the correct file has been served since.

To make sure, I installed 10.0.2 on a Joomla 5.3.1 site, entered the Download Key, clicked on Check for Updates, it found the update, and installed it just fine. No checksum issues.

A bit of background as to what is going on. The update information file contains not just the URL to download the update file from, but also its checksum as a SHA-512 hash. After Joomla downloads the file it calculates the SHA-512 sum of the downloaded file and compares it against the one in our update information file. If they match, it proceeds with the update. If they don't match, you get the error message you saw.

First of all, do you have a writeable temp-folder? Go to System, System Information, Folder Permissions. Scroll all the way down. The very last item is the "Temp folder" and it must show writeable.

Try deleting the files and folders inside your temp folder. This would fix a potential issue where Joomla has already downloaded the package but for any reason it has been corrupt.

Then, you should check that you have the correct Download ID entered. Our documentation has step by step instructions on how to do that.

Go to System, Update, Extensions and click on Check For Updates. Can you install the update now? If you do, for some really weird reason Joomla had cached the broken update information for three months. This is not normal; the update information cache expires after a period of time between 1 and 24 hours depending on settings. In that extensions update page click on Options and check the value for Updates Caching (In Hours). It should be any value except 0. If you leave it to 0, issues like this which do happen across all extensions would make you unable to install any updates.

If none of that helps, then Joomla downloads a broken update file. This would mean that something is broken on your host's side, e.g. they have a transparent caching proxy for the requests made FROM your server TO external sites. We do mark our downloads as "do not cache" in multiple ways, but some hosts do use standards-non-compliant caches which ignore those headers, leading to problems like yours. They are rare, but they do exist.