There are three bug reports about this:

https://bugzilla.redhat.com/show_bug.cgi?id=2214173 - CentOS Stream 8
https://bugzilla.redhat.com/show_bug.cgi?id=2214169 - CentOS Stream 9
https://bugzilla.redhat.com/show_bug.cgi?id=2214178 - CentOS 7

A Stream 9 example:

We have a checksum file here: https://cloud.centos.org/centos/9-stream/x86_64/images/CHECKSUM

Has entries like this:

1. CentOS-Stream-GenericCloud-9-20230612.0.x86_64.qcow2: 1085964800 bytes
   SHA256 (CentOS-Stream-GenericCloud-9-20230612.0.x86_64.qcow2) = bd0b39afe40d06bc7b92279aea9e85372d4dfa2bafe8f02ad11ce486193c44d8

But the latest image called "CentOS-Stream-GenericCloud-9-latest.x86_64.qcow2" can't be verified, because it's not listed. It's the same image as CentOS-Stream-GenericCloud-9-20230612.0.x86_64.qcow2, just having a different filename (-latest vs 20230612.0).

Can we solve this?

How would we deal with mirrors being out of sync and the -latest pointing to a different thing at different places?