{"record":{"id":"0d9ce0f23b00d47a","repo":"twpayne/chezmoi","slug":"sha512-mismatch-expected-s-got-s","errorCode":null,"errorMessage":"SHA512 mismatch: expected %s, got %s","messagePattern":"SHA512 mismatch: expected (.+?), got (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/chezmoi/sourcestate.go","lineNumber":1745,"sourceCode":"\n\tif external.Checksum.SHA256 != nil {\n\t\tif gotSHA256Sum := sha256.Sum256(data); !bytes.Equal(gotSHA256Sum[:], external.Checksum.SHA256) {\n\t\t\tformat := \"SHA256 mismatch: expected %s, got %s\"\n\t\t\terr := fmt.Errorf(format, external.Checksum.SHA256, hex.EncodeToString(gotSHA256Sum[:]))\n\t\t\terrs = append(errs, err)\n\t\t}\n\t}\n\n\tif external.Checksum.SHA384 != nil {\n\t\tif gotSHA384Sum := sha384Sum(data); !bytes.Equal(gotSHA384Sum, external.Checksum.SHA384) {\n\t\t\terrs = append(errs, fmt.Errorf(\"SHA384 mismatch: expected %s, got %s\",\n\t\t\t\texternal.Checksum.SHA384, hex.EncodeToString(gotSHA384Sum)))\n\t\t}\n\t}\n\n\tif external.Checksum.SHA512 != nil {\n\t\tif gotSHA512Sum := sha512Sum(data); !bytes.Equal(gotSHA512Sum, external.Checksum.SHA512) {\n\t\t\terrs = append(errs, fmt.Errorf(\"SHA512 mismatch: expected %s, got %s\",\n\t\t\t\texternal.Checksum.SHA512, hex.EncodeToString(gotSHA512Sum)))\n\t\t}\n\t}\n\n\tif len(errs) != 0 {\n\t\treturn nil, urlStr, fmt.Errorf(\"%s: %w\", externalRelPath, errors.Join(errs...))\n\t}\n\n\tif external.Encrypted {\n\t\tdata, err = s.encryption.Decrypt(data)\n\t\tif err != nil {\n\t\t\treturn nil, urlStr, fmt.Errorf(\"%s: %s: %w\", externalRelPath, urlStr, err)\n\t\t}\n\t}\n\n\tdata, err = decompress(external.Decompress, data)\n\tif err != nil {\n\t\treturn nil, urlStr, fmt.Errorf(\"%s: %w\", externalRelPath, err)","sourceCodeStart":1727,"sourceCodeEnd":1763,"githubUrl":"https://github.com/twpayne/chezmoi/blob/f901167e4685db90da56d6a2a19df642cb3e0247/internal/chezmoi/sourcestate.go#L1727-L1763","documentation":"The SHA512 branch of external checksum verification: if external.Checksum.SHA512 is set and sha512Sum(data) differs from it, this mismatch error is appended to errs and later joined and wrapped with the external's relative path.","triggerScenarios":"External entry declares checksum.sha512; the downloaded data's SHA512 digest does not equal the declared value.","commonSituations":"Pinned release artifact replaced upstream; digest transcribed incorrectly (must be 128 hex chars); hashing the wrong artifact variant (e.g. .sig file instead of the tarball).","solutions":["Recompute with curl -sL <url> | sha512sum and update checksum.sha512.","Alternatively standardize on checksum.sha256 for consistency.","Check the digest length/format (hex, not base64).","Confirm the URL pins an immutable artifact (tag commit or release asset), not a moving 'latest' file."],"exampleFix":"// before\nchecksum.sha512 = \"cf83e1357eefb8bd...\"\n// after\nchecksum.sha512 = \"<sha512sum of the current artifact>\"","handlingStrategy":"validation","validationCode":"curl -sL \"$URL\" | sha512sum\n# Compare with checksum.sha512 (128 hex chars) before applying.","typeGuard":null,"tryCatchPattern":"out, err := exec.Command(\"chezmoi\", \"apply\").CombinedOutput()\nif err != nil && strings.Contains(string(out), \"SHA512 mismatch\") {\n    return errors.New(\"recompute checksum.sha512 or switch to sha256\")\n}","preventionTips":["Never hash a sibling file (e.g. the .sig) by mistake.","Keep exactly one checksum digest per external to reduce maintenance.","Bump the checksum in the same commit/PR that bumps the URL version."],"tags":["checksum","external","integrity","sha512"],"backgroundTag":"checksum-mismatch","analyzedSha":"f901167e4685db90da56d6a2a19df642cb3e0247","analyzedAt":"2026-09-01T18:16:41.508Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T01:17:15.007Z"}