{"record":{"id":"0e184e046583b43d","repo":"elastic/elasticsearch","slug":"unexpected-sha256-response-from","errorCode":null,"errorMessage":"Unexpected sha256 response from [{}]","messagePattern":"Unexpected sha256 response from \\[(.+?)\\]","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"modules/ip-location/src/main/java/org/elasticsearch/ingest/geoip/EnterpriseGeoIpDownloader.java","lineNumber":500,"sourceCode":"            if (endpointPattern.endsWith(\"/\") == false) {\n                endpointPattern += \"/\";\n            }\n            endpointPattern += \"%s/download?suffix=%s\";\n\n            // at this point the pattern looks like this (in the default case):\n            // https://download.maxmind.com/geoip/databases/%s/download?suffix=%s\n\n            return Strings.format(endpointPattern, name, suffix);\n        }\n\n        @Override\n        public Checksum checksum() throws IOException {\n            final String sha256Url = this.url(\"tar.gz.sha256\");\n            var result = new String(httpClient.getBytes(auth.get(), sha256Url), StandardCharsets.UTF_8).trim(); // throws if the auth is bad\n            var matcher = SHA256_CHECKSUM_PATTERN.matcher(result);\n            boolean match = matcher.matches();\n            if (match == false) {\n                throw new RuntimeException(\"Unexpected sha256 response from [\" + sha256Url + \"]\");\n            }\n            final String sha256 = matcher.group(1);\n            return Checksum.sha256(sha256);\n        }\n\n        @Override\n        public CheckedSupplier<InputStream, IOException> download() {\n            final String tgzUrl = this.url(\"tar.gz\");\n            return () -> httpClient.get(auth.get(), tgzUrl);\n        }\n\n        @Override\n        public void close() throws IOException {\n            if (auth != null) auth.close();\n        }\n    }\n\n    class IpinfoDownload implements ProviderDownload {","sourceCodeStart":482,"sourceCodeEnd":518,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/modules/ip-location/src/main/java/org/elasticsearch/ingest/geoip/EnterpriseGeoIpDownloader.java#L482-L518","documentation":"Thrown by MaxmindDownload.checksum() after fetching the <endpoint>/tar.gz.sha256 URL. The body must fully match SHA256_CHECKSUM_PATTERN = (\\w{64})\\s\\s(.*); anything else (an error page, a reformatted checksum line, an empty body) is treated as an unexpected provider response. Wrapped in a RuntimeException, it propagates out of checksum() and aborts the download attempt.","triggerScenarios":"MaxmindDownload.checksum() -> httpClient.getBytes(auth, sha256Url) -> new String(...).trim() -> matcher.matches() == false. Happens when Maxmind returns a maintenance page, a single-space-separated checksum, or an HTML auth error with HTTP 200.","commonSituations":"Maxmind endpoint format change; expired/invalid license key returning a 200 HTML error page; corporate proxy rewriting the body; endpointPattern misconfigured so the URL hits a generic page.","solutions":["Manually GET the sha256 URL printed in the message using the same credentials to inspect the actual body.","Validate the Maxmind license key is active and has download quota.","Confirm the endpointPattern / endpoint override in settings still points at the real Maxmind download host.","If Maxmind changed the delimiter, the pattern constant in EnterpriseGeoIpDownloader needs updating (code change)."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    Checksum cs = maxmindDownload.checksum();\n} catch (RuntimeException e) {\n    // message starts with \"Unexpected sha256 response from\"\n    // fetch the URL manually, inspect the body, fix credentials/endpoint, then retry on next schedule\n    logger.error(\"maxmind sha256 body unparseable for [{}]\", sha256Url, e);\n}","preventionTips":["Keep the Maxmind license key valid and with sufficient quota.","Do not point the endpoint at a host that returns HTML error pages with HTTP 200.","If the Maxmind format changes, update SHA256_CHECKSUM_PATTERN promptly.","Log the raw body when this fires so the cause is visible."],"tags":["geoip","maxmind","checksum","network","response-format"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}