SHA256 mismatch for {} from {}! expected: {expected} act

Error message

SHA256 mismatch for {} from {}!
  expected: {expected}
  actual:   {actual}

What it means

During self-update, Codewhale downloads the release binary plus a checksum manifest, then compares the manifest's SHA256 for the binary against a locally computed digest of the downloaded bytes. A mismatch aborts the update before anything is replaced. This is a tamper/corruption check: the download you received is not byte-identical to what the release signed off on.

Source

Thrown at crates/cli/src/update.rs:188

/// Fail closed when the downloaded bytes do not match the manifest that came
/// from the same source. A mismatch is never a reason to install anyway, and
/// never a reason to retry against the source that lost the probe: the two
/// build their own artifacts, so their checksums are not interchangeable.
fn verify_downloaded_asset(download: &DownloadPlan, bytes: &[u8]) -> Result<()> {
    let expected = download
        .checksums
        .get(&download.binary_name)
        .with_context(|| {
            format!(
                "{CHECKSUM_MANIFEST_ASSET} from {} is missing {}",
                download.source.describe(),
                download.binary_name
            )
        })?;
    let actual = sha256_hex(bytes);
    if !actual.eq_ignore_ascii_case(expected) {
        bail!(
            "SHA256 mismatch for {} from {}!\n  expected: {expected}\n  actual:   {actual}",
            download.binary_name,
            download.source.describe()
        );
    }
    Ok(())
}

/// Warn when self-update would overwrite a binary a package manager owns.
///
/// We warn rather than refuse: the download still produces a working newer
/// binary, and refusing would break workflows that have been doing this for
/// releases. But the manager's metadata will then describe a version that is
/// no longer on disk, and its next upgrade silently reverts the user — so say
/// so, and name the command that would have done this properly.
fn managed_install_warning(method: InstallMethod) -> Option<String> {
    if method.supports_self_update() {
        return None;

View on GitHub (pinned to 0c42157ee5)

Solutions

Re-run the update — transient corruption is the most common cause and a clean re-download fixes it
Manually verify: download the binary and checksum manifest, run `sha256sum` and compare; if the official assets themselves mismatch, report it to the Codewhale project
Eliminate the rewriter: bypass the HTTP proxy / disable TLS-inspecting AV for the download, or fetch from the official release URL directly
If it persists across networks, treat it as suspicious — update only from the official source and report the checksums

Example fix

# before
$ codewhale update
# SHA256 mismatch for codewhale-linux-x86_64 from github-release!
#   expected: aa11...
#   actual:   ff09...

# after
$ codewhale update   # clean re-download; if still failing:
$ curl -fLO <official-release-url>/codewhale-linux-x86_64
$ sha256sum codewhale-linux-x86_64   # compare to manifest before installing

Defensive patterns

Strategy: retry

Validate before calling

#!/usr/bin/env bash
# verify assets yourself before trusting an update
url="https://github.com/<org>/releases/download/vX.Y.Z"
curl -fLO "$url/codewhale-linux-x86_64" "$url/checksums.txt"
sha256sum -c --ignore-missing checksums.txt && codewhale update

Try / catch

# shell: retry once on mismatch, escalate on repeat
for i in 1 2; do
  if codewhale update; then break; fi
  [ "$i" = 2 ] && { echo "checksum mismatch persists — possible tampering/proxy rewrite" >&2; exit 1; }
done

Prevention

Pin downloads to the official release URL and verify SHA256 yourself when automating updates
Exempt release binaries from TLS-inspecting proxies/AV, or fetch on an untampered network
Never bypass or ignore the mismatch — the check is the last line before binary replacement

When it happens

Trigger: Truncated or corrupted download (dropped connection); an HTTP proxy, antivirus, or captive portal rewriting the binary; a CDN/cache serving a stale or mixed manifest+binary pair; a supply-chain attack; a partially-written disk.

Common situations: Corporate proxies that 'inspect' and mangle binaries; flaky hotel/VPN networks; system clock or TLS interception tools; mirrors out of sync; disk-full during download.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/0c799c68386f60d9. Report an issue: GitHub.