{"record":{"id":"006143cdf52d80b8","repo":"kubernetes/kops","slug":"different-sha-for-same-file-s-s-vs-s","errorCode":null,"errorMessage":"different sha for same file %s: %s vs %s","messagePattern":"different sha for same file (.+?): (.+?) vs (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/assets/assetcopy/copy.go","lineNumber":78,"sourceCode":"\t\t\tcopyFileTask := &CopyFile{\n\t\t\t\tName:       fileAsset.CanonicalURL.String(),\n\t\t\t\tTargetFile: fileAsset.DownloadURL.String(),\n\t\t\t\tSourceFile: fileAsset.CanonicalURL.String(),\n\t\t\t\tSHA:        fileAsset.SHAValue.Hex(),\n\t\t\t\tVFSContext: vfsContext,\n\t\t\t\tCluster:    cluster,\n\t\t\t}\n\n\t\t\tif existing, ok := tasks[copyFileTask.Name]; ok {\n\t\t\t\te, ok := existing.(*CopyFile)\n\t\t\t\tif !ok {\n\t\t\t\t\treturn fmt.Errorf(\"different types for copy target %s\", copyFileTask.Name)\n\t\t\t\t}\n\t\t\t\tif e.TargetFile != copyFileTask.TargetFile {\n\t\t\t\t\treturn fmt.Errorf(\"different targets for same file %s: %s vs %s\", copyFileTask.Name, copyFileTask.TargetFile, e.TargetFile)\n\t\t\t\t}\n\t\t\t\tif e.SHA != copyFileTask.SHA {\n\t\t\t\t\treturn fmt.Errorf(\"different sha for same file %s: %s vs %s\", copyFileTask.Name, copyFileTask.SHA, e.SHA)\n\t\t\t\t}\n\t\t\t}\n\n\t\t\ttasks[copyFileTask.Name] = copyFileTask\n\t\t}\n\t}\n\n\tch := make(chan error, 5)\n\tfor i := 0; i < cap(ch); i++ {\n\t\tch <- nil\n\t}\n\n\tgotError := false\n\tnames := make([]string, 0, len(tasks))\n\tfor name := range tasks {\n\t\tnames = append(names, name)\n\t}\n\tsort.Strings(names)","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/assets/assetcopy/copy.go#L60-L96","documentation":"When two *CopyFile tasks share the same name and target file but declare different SHA checksums, Copy cannot know which content is correct and would risk copying tampered or mixed-version files, so it fails with this error. The SHA acts as the content-integrity dedup key for files.","triggerScenarios":"Two FileAssets with identical task name and TargetFile but different SHA fields processed in one Copy call, typically from assets lists built at different kOps versions or from modified file assets.","commonSituations":"Upgrading a cluster where a nodeup/file asset was rebuilt with different content (new binary hash) while old and new asset definitions coexist; custom fileAssets overriding a builtin asset with different content; partially updated manifest templates.","solutions":["Rebuild the asset list from a single consistent kOps version so all SHA values for a file agree","Remove stale duplicate fileAsset overrides that declare an old SHA for the same target","Verify the file content and recompute the SHA if you intentionally changed the file, updating all references"],"exampleFix":"// before\n// fileAssets:\n//   - name: nodeup, target: /opt/nodeup, sha: aaa111\n//   - name: nodeup, target: /opt/nodeup, sha: bbb222\n// after\n//   - name: nodeup, target: /opt/nodeup, sha: bbb222  (single consistent entry)","handlingStrategy":"validation","validationCode":"fileSHAs := map[string]string{}\nfor _, f := range fileAssets {\n\tkey := f.Name + \"|\" + f.TargetFile\n\tif prev, ok := fileSHAs[key]; ok && prev != f.SHA {\n\t\treturn fmt.Errorf(\"pre-check: file %s has conflicting SHAs %s vs %s\", key, prev, f.SHA)\n\t}\n\tfileSHAs[key] = f.SHA\n}","typeGuard":"func fileSHAsConsistent(files []FileAsset) bool {\n\tseen := map[string]string{}\n\tfor _, f := range files {\n\t\tkey := f.Name + \"|\" + f.TargetFile\n\t\tif p, ok := seen[key]; ok && p != f.SHA {\n\t\t\treturn false\n\t\t}\n\t\tseen[key] = f.SHA\n\t}\n\treturn true\n}","tryCatchPattern":"if err := copy.Run(ctx); err != nil {\n\tif strings.Contains(err.Error(), \"different sha for same file\") {\n\t\treturn fmt.Errorf(\"asset integrity bug: %w — rebuild assets from one kOps version\", err)\n\t}\n\treturn err\n}","preventionTips":["Rebuild asset lists from a single consistent kOps version after upgrades","Recompute and update SHAs whenever file content intentionally changes","Remove stale custom fileAssets that override builtins with old checksums","Verify SHAs against upstream published checksums before applying"],"tags":["assets","files","integrity"],"backgroundTag":"asset-sha-mismatch","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}