Just did a fresh installation on a ubuntu 12.04 machine:

$ wget -q -O - http://pkg.jenkins-ci.org/debian/jenkins-ci.org.key | sudo apt-key add -
$ sudo vi /etc/apt/sources.list.d/jenkins.list
Add "deb http://pkg.jenkins-ci.org/debian binary/"
$ sudo apt-get update
$ sudo apt-get install jenkins

and I'm getting an

SEVERE: ERROR: Digest mismatch: computed=Z2TCx+SJViE/ramc6FtkJFZ3rR0= vs expected=YDF3DewMNvr8sz4yn1vv16a996U= in update site 'default'

on Jenkins 1.509

Same issue for Jenkins 1.510

Apr 10, 2013 8:41:53 AM hudson.model.UpdateSite updateData
SEVERE: ERROR: Digest mismatch: computed=3rUPiGC7AkQPAVu7sqkFG67UQbg= vs expected=WdzM/h38DGHKtm23NRhUWtZGrbg= in update site 'default'

Same here with 1.510 on both Ubuntu server and a local mac.

the latest release 1.511 is also broken. installing 1.481 which is reported as ok at https://groups.google.com/forum/#!msg/jenkinsci-users/Il4DjO726xo/ppdUK0REJvwJ also fails. this seems to be a serious and recurrent issue - see also https://issues.jenkins-ci.org/browse/JENKINS-11110

how am i supposed to configure mercurial access without plugins? is there no workaround?

HELLO? ANYBODY THERE?

A diff against the current trunk to remove the checks is:

diff --git a/core/src/main/java/jenkins/util/JSONSignatureValidator.java b/core/src/main/java/jenkins/util/JSONSignatureValidator.java
index 684f8eb..641d25e 100644
--- a/core/src/main/java/jenkins/util/JSONSignatureValidator.java
+++ b/core/src/main/java/jenkins/util/JSONSignatureValidator.java
@@ -130,12 +130,12 @@ public class JSONSignatureValidator {
                     LOGGER.severe(msg);
                     LOGGER.severe(o.toString(2));
                 }
-                return FormValidation.error(msg);
+               // return FormValidation.error(msg);
             }
 
             String providedSignature = signature.getString("correct_signature");
             if (!sig.verify(Base64.decode(providedSignature.toCharArray()))) {
-                return FormValidation.error("Signature in the update center doesn't match with the certificate in "+name);
+                // return FormValidation.error("Signature in the update center doesn't match with the certificate in "+name);
             }
 
             if (warning!=null)  return warning;
diff --git a/pom.xml b/pom.xml
index 1d098c9..bf961d4 100644
--- a/pom.xml
+++ b/pom.xml
@@ -33,7 +33,7 @@ THE SOFTWARE.
 
   <groupId>org.jenkins-ci.main</groupId>
   <artifactId>pom</artifactId>
-  <version>1.513-SNAPSHOT</version>
+  <version>1.513-SNAPSHOT-NOCHECK</version>
   <packaging>pom</packaging>
 
   <name>Jenkins main module</name>

The repo at https://github.com/andrewcooke/jenkins contains the fix above. It's just a snapshot of the current tree today (like, an hour ago) plus the hack above. It's very easy to build - just follow the instructions in BUILDING.TXT (you need maven to be installed first).

PS Also, it works - plugins now available.

1.514 still broken for me on Debian (wheezy).

Same here:

SEVERE: ERROR: Digest mismatch: computed=AN2CENXxCIQlAGGWm2jdT7xWqLs= vs expected=HHGarvNOLe1YgEh8NGiChOuXfhc= in update site 'default'

That's from 1.514 running on two separate installs of Ubuntu 12.10. As of yet haven't figured out what is missing to allow this to work. Both boxes have openssl installed FWIW.

It is happening now once again.

hudson.model.UpdateSite updateData
SEVERE: ERROR: Digest mismatch: vCzo4VShUNOq+D3L/OhKVMzF0ms= vs RbxnYzSwuJIFmMJJSZ4RqZI6vdQ= in update site 'default'

I am having this problem on a new Jenkins installation and I can't install any plugins.

I also have an older install with the same issue, but there I already have the plugins that I need already installed.

I wish there was a way to override this check without recompiling Jenkins, through the settings.

Original issue long since fixed. I can not reproduce any issue with a current Jenkins dev build and the current update center. If anyone can, see JENKINS-17677 for details on how to gather suitable diagnostics.