ova file "is invalid and cannot be deployed"

[Scott Moser]

Trying to deploy a OVA file (20181015)
 bionic-server-cloudimg-amd64.ova
on vmware via vsphere client results in an error:

The OVF package is invalid and cannot be deployed.

https://kb.vmware.com/s/article/2151537

The simple fix is to use sha1 as the hashing algorithm.
$ cat ubuntu-bionic-18.04-cloudimg.mf.dist
SHA256(ubuntu-bionic-18.04-cloudimg.vmdk)= 085e0972fdbba9708b0769ec442799740ee5e7db6608bc3ba61976d99d88ca7b
SHA256(ubuntu-bionic-18.04-cloudimg.ovf)= 3ed6ca04562280f910517c634f9b2c09a60bc42f0f038be03b6fdd116add91cd

thats the original, the one that works looks like:

$ cat ubuntu-bionic-18.04-cloudimg.mf
SHA1(ubuntu-bionic-18.04-cloudimg.vmdk)= d46c837ab158f4d15fbb7bfe386a89bdfabcc511
SHA1(ubuntu-bionic-18.04-cloudimg.ovf)= 915f1cd3aa7ce5ba01776be73059429f5e0305d0

[Scott Moser (smoser)]

Ugh.

Digging a little, I've found that in Version 2.0.0 (dated 2012-12-13) [1]:

   OVF packages authored according to this version of the specification shall
   use SHA256 digests; older OVF packages are allowed to use SHA1.

The 2.1.1 specification [2] dated 2015-08-27 has dropped the
'older OVF packages..' text. So it definitely seems like we should be
writing OVA files with the SHA256 digest.

For reference, the specific version of vSphere Client that I was using was:
  vSphere Client
  Version 6.0.0
  Build 5112508
and
  VmWare vCenter Server
  Version 6.0.0
  Build 2776510

--
[1] https://www.dmtf.org/sites/default/files/standards/documents/DSP0243_2.1.1.pdf
[2] https://www.dmtf.org/sites/default/files/standards/documents/DSP0243_2.0.0.pdf

[Scott Moser (smoser)]

Marked this invalid. If we only produce one OVA we can only produce one hashing algorithm and going backwards to sha1 doesn't make much sense.