Either Textpattern's site was hacked

Or they failed to update the SHASUM. If you go to their Git, and download the SHASUM file, it matches the file on their site.

So which checksum is it? The one on their site, or the one on their Git?

The checksum on their site, matches the previous version, no I don’t delete anything.

No announcement on their forum.

The correct checksum is on the blog post, just not their download page.