JanDeDobbeleer/oh-my-posh · critical

checksum mismatch

Error message

checksum mismatch

What it means

After locating the asset's expected SHA256 in the checksums file, validateChecksum computes the SHA256 of the downloaded binary and compares them. A mismatch means the downloaded binary differs from what the project signed, so the upgrade aborts to prevent installing tampered or corrupted code.

Source

Thrown at src/cli/upgrade/verify.go:141

		if !strings.HasSuffix(line, asset) {
			continue
		}

		assetChecksum = strings.Fields(line)[0]
		break
	}

	if assetChecksum == "" {
		log.Debug("failed to find checksum for asset")
		return fmt.Errorf("failed to find checksum for asset")
	}

	// calculate the checksum of the binary
	binaryChecksum := fmt.Sprintf("%x", sha256.Sum256(binary))

	if assetChecksum != binaryChecksum {
		log.Debugf("checksum mismatch, expected: %s, got: %s", assetChecksum, binaryChecksum)
		return fmt.Errorf("checksum mismatch")
	}

	return nil
}

View on GitHub (pinned to 0976794618)

Solutions

1. Re-run the upgrade — most cases are transient download corruption
2. Bypass or disable TLS-intercepting proxies/caches
3. Verify manually: download the asset and compare against the published checksums on the release page
4. Install via the official install script or a package manager as a fallback

if err := cli.Upgrade(); err != nil {
    if strings.Contains(err.Error(), "checksum mismatch") {
        // do NOT install; retry download once, then verify manually / use official installer
    }
}

When it happens

Trigger: verify → validateChecksum where sha256(binary) != the checksum listed in sha256sums — truncated or corrupted download, disk corruption, or a modified binary (MITM or malicious proxy).

Common situations: Flaky network interrupting the asset download; proxy/cache serving a stale or altered file; security software modifying binaries on disk.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• failed to verify checksums signature
• error parsing PEM block: key not found
• error parsing public key: %v
• invalid public key format: %v
• failed to find checksum for asset

AI-assisted analysis of JanDeDobbeleer/oh-my-posh@0976794618 (2026-08-31). Data as JSON: /api/errors/ebad62252e4986ae. Report an issue: GitHub.