Macoscx 10.6.8 Combo Update v1.1 Checksum Mismatch

I am attempting to archive 10.6 components for potential future use on a date 2010 MacMini. I have downloaded using Safari the referenced combo pkg from here

Mac OS X 10.6.8 Update Combo v1.1 - Apple Support


I have also reviewed the referenced article as to the certificate found here

How to verify the authenticity of manually downloaded Apple software updates - Apple Support


The "article" provides a SH256 hash but the certificate only identifies a SH1 hash

The certificate is "good", green check mark

In any event, when I use terminal to run shasum on the .pkg for both SH256 and SH1, neither of the results match either the article's SH256 number nor the certificates SH1 value.


Not sure at this point if I can "trust" the download given these mixed results

Observations welcome

TNX

2020 M1 MacMini Monterey

Earlier Mac models

Posted on Feb 22, 2025 10:21 AM

Reply

Similar questions

5 replies

Feb 22, 2025 12:50 PM in response to John Galt

Hello John

Thank you for the prompt and informative reply

I use the 2010 MacMini with 10.6.8 exclusively offline to create family videos using iMovie'6 HD (its a very nice package).


It looks like the .pkg was created 2014 and updated 2019. I used both the 2010 Mini terminal to check the hash as well as my current M1 Mini. I would have expected one of them to match the "article's" SH256 string. Maybe neither is a good match timing wise.


In any event I have several CCC backups in the likely event that the old original drive will someday fail. So saying I'm hoping to cover all my bases. I have the original 2 gray DVDs that came with the machine 10.6.4 and was looking to archive the update package in the event things went really south and I had to install from scratch. Based on your comments it looks as if I'm at the best spot possible given the age. Too bad the "article" doesn't give a hint as to what to expect given that things appear to have been "updated Nov 2023"

TNX

Feb 22, 2025 1:29 PM in response to dana116

You're well prepared for every contingency.


iMovie 6 was indeed a very nice package. It's my opinion that Apple "dumbed it down" with later versions. We can just make low quality movies a lot faster. Kind of the way Hollywood has been going.


That "how to verify the authenticity" Apple Support document has been updated, and I can't find an archived version of what it had been around the time of that Combo package. I know I used it in the recent past, and have no reason to believe it can't be trusted. My sole concern would be that it's hosted on Apple's servers, which it is.

Feb 23, 2025 8:56 AM in response to dana116

Additional observations - comments welcome

I opened up the combo .dmg to reveal the .pkg

Created date is Nov 6, 2014

Modified date is Aug 7, 2019

  1. Cert appears to be valid - green checkmark (good to 2019)
  2. At the bottom of the details page are MD5 and SHA1 fingerprints

When I perform those checks using terminal I do not get the strings as identified in the cert

Is it possible Apple updated the cert date which changed the checksum values but failed to update the SHA1 and MD5 values to reflect the effects the date change caused ?

Thanks




Feb 25, 2025 1:49 PM in response to dana116

All

A correction to my previous post on this subject. Current certificate expiration date is 2029 not 2019


I suspect that if the Installer checks the “hash” on the current .pkg and finds that it doesn’t match the values stated in the certificate (and it will not), it will likely balk at continuing the install. That’s just a guess and I hopefully will never have to find out if I’m right.


Thanks to all of you who have taken a look at my posts



This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Macoscx 10.6.8 Combo Update v1.1 Checksum Mismatch

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.