{"record":{"id":"0ab67276420de0b9","repo":"microsoft/aspire","slug":"embedded-aspire-skills-archive-failed-sha-512-verification","errorCode":null,"errorMessage":"Embedded Aspire skills archive failed SHA-512 verification. Expected '{0}', got '{1}'.","messagePattern":"Embedded Aspire skills archive failed SHA-512 verification\\. Expected '(.+?)', got '(.+?)'\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Cli/Agents/AspireSkills/AspireSkillsBundleProvider.cs","lineNumber":460,"sourceCode":"    }\n\n    internal static string NormalizeSha256(string sha256)\n    {\n        return sha256.StartsWith(\"sha256-\", StringComparison.OrdinalIgnoreCase) ||\n            sha256.StartsWith(\"sha256:\", StringComparison.OrdinalIgnoreCase)\n                ? sha256[7..]\n                : sha256;\n    }\n\n    private static void ValidateArchiveSha512(string archivePath, string expectedSha512)\n    {\n        var expectedHash = NormalizeSha512(expectedSha512);\n        using var stream = File.OpenRead(archivePath);\n        var actualHash = Convert.ToHexString(SHA512.HashData(stream)).ToLowerInvariant();\n\n        if (!string.Equals(expectedHash, actualHash, StringComparison.OrdinalIgnoreCase))\n        {\n            throw new InvalidOperationException(string.Format(\n                CultureInfo.CurrentCulture,\n                AgentCommandStrings.AspireSkillsInstaller_ArchiveHashVerificationFailed,\n                expectedHash,\n                actualHash));\n        }\n    }\n\n    private static void ExtractArchive(string archivePath, string destinationDirectory)\n    {\n        if (archivePath.EndsWith(\".zip\", StringComparison.OrdinalIgnoreCase))\n        {\n            ExtractZipArchive(archivePath, destinationDirectory);\n            return;\n        }\n\n        ExtractTarball(archivePath, destinationDirectory);\n    }\n","sourceCodeStart":442,"sourceCodeEnd":478,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Cli/Agents/AspireSkills/AspireSkillsBundleProvider.cs#L442-L478","documentation":"Before extracting an embedded/downloaded Aspire skills archive, ValidateArchiveSha512 recomputes the SHA-512 of the archive file and compares it to the expected hash. A mismatch means the archive is corrupted, truncated, or tampered with, so Aspire throws this InvalidOperationException and refuses to extract it.","triggerScenarios":"AspireSkillsBundleProvider.CreateAsync downloads or materializes an archive whose computed SHA-512 differs from the expectedSha512 value bundled with the CLI.","commonSituations":"Interrupted or proxied downloads; a CDN or corporate proxy altering the payload; a published archive updated without updating the pinned hash; CLI version mismatch where an older CLI fetches a newer archive.","solutions":["Re-download the archive (clear caches) so the bytes match the pinned SHA-512","Update the Aspire CLI to the version that ships the matching expected hash","If you publish the archive yourself, update the expectedSha512 constant to the new file's hash"],"exampleFix":"// before (pinned hash computed from an old archive)\nprivate const string ExpectedSha512 = \"aaaa...\";\n// after (hash of the current archive)\nprivate const string ExpectedSha512 = \"<sha512 of the republished archive>\";","handlingStrategy":"retry","validationCode":"using var s = File.OpenRead(archivePath);\nvar actual = Convert.ToHexString(SHA512.HashData(s)).ToLowerInvariant();\nif (actual != expectedSha512.ToLowerInvariant()) throw new Exception(\"Archive hash mismatch; re-download.\");","typeGuard":null,"tryCatchPattern":"try { await provider.CreateAsync(...); }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"SHA-512 verification\")) { /* delete cache and re-download archive */ }","preventionTips":["Verify downloads complete before extraction (retry on flaky networks)","Keep the expected hash in sync whenever the archive is republished","Update the CLI when an archive version changes upstream"],"tags":["archive","security","hash","download"],"backgroundTag":"checksum-mismatch","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}