1Panel-dev/1Panel · error · ValueError

checksum-mismatch

Error message

checksum-mismatch

What it means

Raised when the SHA-256 of the artifact file (computed in 1 MiB chunks) does not match, case-insensitively, the 'checksum' recorded in the manifest. It means the file on disk is not the bytes the build produced: truncated download, partial write, wrong version, or bit rot.

Source

Thrown at scripts/openresty-modules/diagnose-install.sh:232

            try:
                pure = pathlib.PurePosixPath(relative)
                if not relative or pure.is_absolute() or ".." in pure.parts or "\\" in relative:
                    raise ValueError("unsafe-path")
                candidate = modules_root / pathlib.Path(*pure.parts)
                if candidate.is_symlink():
                    raise ValueError("symlink-not-allowed")
                full_path = candidate.resolve(strict=True)
                if modules_root not in full_path.parents:
                    raise ValueError("outside-module-root")
                if not full_path.is_file():
                    raise ValueError("not-regular-file")
                digest = hashlib.sha256()
                with full_path.open("rb") as handle:
                    for chunk in iter(lambda: handle.read(1024 * 1024), b""):
                        digest.update(chunk)
                actual = digest.hexdigest()
                if actual.lower() != expected.lower():
                    raise ValueError("checksum-mismatch")
            except Exception as error:
                result = str(error)
                failed = True
            print("\t".join([
                module.get("name", ""), build.get("status", ""), target_key,
                relative, expected, actual, result,
            ]))
sys.exit(1 if failed else 0)
PY
    then
        mark_passed "artifact paths and checksums"
    else
        mark_failed "artifact paths or checksums"
    fi
}

validate_managed_configs() {
    if python3 - "${INSTALL_DIR}/conf/modules-enabled" "${INSTALL_DIR}/modules" \

View on GitHub (pinned to 5ac7c80881)

Solutions

1. Re-download/reinstall the module artifact from the trusted source so the file matches the manifest checksum (sha256sum <file> to confirm)
2. If the file was rebuilt intentionally, regenerate the manifest checksum from the new artifact
3. Check disk space and filesystem health if corruption recurs (df -h; dmesg | tail)

Example fix

# before: file on disk mismatches manifest
sha256sum modules/resty/http.so   # a1b2...
# after: reinstall from trusted source
1pctl reinstall openresty-module <name>   # or restore artifact, then
sha256sum modules/resty/http.so   # must equal manifest checksum

python3 -c "import hashlib,sys; print(hashlib.sha256(open(sys.argv[1],'rb').read()).hexdigest())" <modules_root>/<path>  # compare to manifest checksum

When it happens

Trigger: diagnose-install.sh iterates build.artifacts, hashes modules_root/<path>, and actual.lower() != expected.lower() — e.g. a half-written .so after an interrupted install, or an artifact replaced by a different build of the same name.

Common situations: Interrupted upgrade (out of disk during unpack); a module recompiled locally with different flags but the manifest kept the CI checksum; download proxy corrupted the tarball; case mismatch is tolerated so that part is not the cause.

Related errors

• unsafe-path
• symlink-not-allowed
• outside-module-root
• not-regular-file
• unexpected-container-path

AI-assisted analysis of 1Panel-dev/1Panel@5ac7c80881 (2026-08-15). Data as JSON: /api/errors/6d1f6931a1ab5a7c. Report an issue: GitHub.