I have several proprietary Drupal modules that my company uses. We want to update these across all our sites. To that end, I've built an endpoint that produces code according to the (ill-documented) specifications required at https://www.drupal.org/node/542202#project%20status%20url

For those interested, the endpoint gets the project information from Bitbucket, where each core has a branch, then gets tags and parses out the tags as releases so it can get the newest one.

There's also some unzipping and re-zipping that goes on to put the returned .tar.gz in a format that Drupal accepts.

This works alright but there's a


While the GUI for Drupal works fine to update the module from the custom remote, Drush fails. Running drush up gives me the expected prompts, recognizes the new version, downloads the file and then fails. The message:

File {filename} is corrupt (wrong md5 checksum).

The mdhash in my XML file is correct, according to the md5 utility on MacOS. (It's calculated using PHP's md5_file utility). So, whenever I download the tar manually and check the hash, it's fine. But I cannot get drush to agree with me.

Any ideas? Thanks in advance.

  • Did you try drush-pm-update. I saw that other users that used a make file runned update just without the --no-cache parameter, and that helped.
    – user72672
    Mar 29, 2018 at 20:37

1 Answer 1



This isn't a good answer, but it works:

There is an undocumented drush flag --no-md5 and if you pass that to drush up it will skip the md5 check and the update will succeed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.