{"record":{"id":"0c799c68386f60d9","repo":"Hmbown/CodeWhale","slug":"sha256-mismatch-for-from-expected-expec","errorCode":null,"errorMessage":"SHA256 mismatch for {} from {}!\n  expected: {expected}\n  actual:   {actual}","messagePattern":"SHA256 mismatch for (.+?) from (.+?)!\n  expected: (.+?)\n  actual:   (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"crates/cli/src/update.rs","lineNumber":188,"sourceCode":"\n/// Fail closed when the downloaded bytes do not match the manifest that came\n/// from the same source. A mismatch is never a reason to install anyway, and\n/// never a reason to retry against the source that lost the probe: the two\n/// build their own artifacts, so their checksums are not interchangeable.\nfn verify_downloaded_asset(download: &DownloadPlan, bytes: &[u8]) -> Result<()> {\n    let expected = download\n        .checksums\n        .get(&download.binary_name)\n        .with_context(|| {\n            format!(\n                \"{CHECKSUM_MANIFEST_ASSET} from {} is missing {}\",\n                download.source.describe(),\n                download.binary_name\n            )\n        })?;\n    let actual = sha256_hex(bytes);\n    if !actual.eq_ignore_ascii_case(expected) {\n        bail!(\n            \"SHA256 mismatch for {} from {}!\\n  expected: {expected}\\n  actual:   {actual}\",\n            download.binary_name,\n            download.source.describe()\n        );\n    }\n    Ok(())\n}\n\n/// Warn when self-update would overwrite a binary a package manager owns.\n///\n/// We warn rather than refuse: the download still produces a working newer\n/// binary, and refusing would break workflows that have been doing this for\n/// releases. But the manager's metadata will then describe a version that is\n/// no longer on disk, and its next upgrade silently reverts the user — so say\n/// so, and name the command that would have done this properly.\nfn managed_install_warning(method: InstallMethod) -> Option<String> {\n    if method.supports_self_update() {\n        return None;","sourceCodeStart":170,"sourceCodeEnd":206,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/cli/src/update.rs#L170-L206","documentation":"During self-update, Codewhale downloads the release binary plus a checksum manifest, then compares the manifest's SHA256 for the binary against a locally computed digest of the downloaded bytes. A mismatch aborts the update before anything is replaced. This is a tamper/corruption check: the download you received is not byte-identical to what the release signed off on.","triggerScenarios":"Truncated or corrupted download (dropped connection); an HTTP proxy, antivirus, or captive portal rewriting the binary; a CDN/cache serving a stale or mixed manifest+binary pair; a supply-chain attack; a partially-written disk.","commonSituations":"Corporate proxies that 'inspect' and mangle binaries; flaky hotel/VPN networks; system clock or TLS interception tools; mirrors out of sync; disk-full during download.","solutions":["Re-run the update — transient corruption is the most common cause and a clean re-download fixes it","Manually verify: download the binary and checksum manifest, run `sha256sum` and compare; if the official assets themselves mismatch, report it to the Codewhale project","Eliminate the rewriter: bypass the HTTP proxy / disable TLS-inspecting AV for the download, or fetch from the official release URL directly","If it persists across networks, treat it as suspicious — update only from the official source and report the checksums"],"exampleFix":"# before\n$ codewhale update\n# SHA256 mismatch for codewhale-linux-x86_64 from github-release!\n#   expected: aa11...\n#   actual:   ff09...\n\n# after\n$ codewhale update   # clean re-download; if still failing:\n$ curl -fLO <official-release-url>/codewhale-linux-x86_64\n$ sha256sum codewhale-linux-x86_64   # compare to manifest before installing","handlingStrategy":"retry","validationCode":"#!/usr/bin/env bash\n# verify assets yourself before trusting an update\nurl=\"https://github.com/<org>/releases/download/vX.Y.Z\"\ncurl -fLO \"$url/codewhale-linux-x86_64\" \"$url/checksums.txt\"\nsha256sum -c --ignore-missing checksums.txt && codewhale update","typeGuard":null,"tryCatchPattern":"# shell: retry once on mismatch, escalate on repeat\nfor i in 1 2; do\n  if codewhale update; then break; fi\n  [ \"$i\" = 2 ] && { echo \"checksum mismatch persists — possible tampering/proxy rewrite\" >&2; exit 1; }\ndone","preventionTips":["Pin downloads to the official release URL and verify SHA256 yourself when automating updates","Exempt release binaries from TLS-inspecting proxies/AV, or fetch on an untampered network","Never bypass or ignore the mismatch — the check is the last line before binary replacement"],"tags":["checksum","sha256","update","security","download","integrity"],"backgroundTag":"checksum-mismatch","analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}