steps:
  • downloaded virtualbox .ova file of Kali x64, 2020.2a and verified hash
  • import as virtualbox appliance and start
  • sudo apt-get update fails with:

E: Failed to fetch http://mirrors.ocf.berkeley.edu/kali...64/Packages.gz Hash Sum mismatch
Hashes of expected file:
- Filesize:16657172 [weak]
- SHA256:39517d0666b1431342676f93dd481448ed27d6f50fa0a69a06 568be98a4492d2
- SHA1:11992919cc5878e6ab023c6a89abc4ced49e69ca [weak]
- MD5Sum:3bad68e39c1647cc1366dbfd425c3d9b [weak]
Hashes of received file:
- SHA256:60af05f09ae13d782516496e1a0543d840dfc714d80 e8cfba2d3ed4e09f0f771


I manually changed to some of the repos listed in http://http.kali.org/README.mirrorlist
I tried other mirrors in US and Europe - each time same expected hash but different actual hash reported by apt

I downloaded one of the files and checked the hash, and it is what it is expected to be:

sha256sum -b ~/Downloads/Packages.gz
39517d0666b1431342676f93dd481448ed27d6f50fa0a69a06 568be98a4492d2 */home/kali/Downloads/Packages.gz


so it looks like apt is corrupting the file or incorrectly calculating hash?
I deleted and recreated the VM from the ova file, but same result.
Anyone know a fix?