For the JDK 23 version on this site https://jdk.java.net/23/, the checksums mentioned for

macOS / AArch64 tar.gz (sha256) 204386158

don't match the checksums or the file size.

The checksum for MacOS /AArch64 shows cd626e636fdd7e68467a9ca27d71107a27bd500c33ab40a91b57317c0c0f949f on the website, however verifying locally on the Mac gives a different SHA256 checksum.

sha256sum openjdk-23.0.1_macos-aarch64_bin.tar 01c0d6f40533472a5caed6e40f943c120e943a03fcb335da0b081d2520053d24 openjdk-23.0.1_macos-aarch64_bin.tar

What gives? Also the website shows the filesize as 204386158 (or 194.9MB), but the local downloaded file is 349.7MB. Am I doing something wrong or is the OpenJDK site hacked?

Looks correct to me - from output look in you are doing it on TAR which is wrong. You do it on TAR.GZ file.

sha256sum openjdk-23.0.1_macos-aarch64_bin.tar.gz

What the other comment said. You're comparing your tar file size and checksum with the size and checksum of the tar.gz file. Apple to oranges.

You are right Mac automatically unzips the file, doing the checksum on the gz file matches. False alarm.