{"record":{"id":"0e3c939282102c16","repo":"xpzouying/xiaohongshu-mcp","slug":"s-sha256-s-s","errorCode":null,"errorMessage":"%s SHA256 不匹配：期望 %s，实际 %s","messagePattern":"(.+?) SHA256 不匹配：期望 (.+?)，实际 (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"browser/browser_download.go","lineNumber":145,"sourceCode":"\n// verifySHA256 下载同目录的 SHA256SUMS，校验 asset 的哈希。\nfunc verifySHA256(archivePath, asset string) error {\n\twant, err := fetchExpectedSHA(asset)\n\tif err != nil {\n\t\treturn err\n\t}\n\tf, err := os.Open(archivePath)\n\tif err != nil {\n\t\treturn err\n\t}\n\tdefer f.Close()\n\th := sha256.New()\n\tif _, err := io.Copy(h, f); err != nil {\n\t\treturn err\n\t}\n\tgot := hex.EncodeToString(h.Sum(nil))\n\tif !strings.EqualFold(got, want) {\n\t\treturn fmt.Errorf(\"%s SHA256 不匹配：期望 %s，实际 %s\", asset, want, got)\n\t}\n\treturn nil\n}\n\nfunc fetchExpectedSHA(asset string) (string, error) {\n\tresp, err := (&http.Client{Timeout: 30 * time.Second}).Get(browserURL(\"SHA256SUMS\"))\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tdefer resp.Body.Close()\n\tif resp.StatusCode != http.StatusOK {\n\t\treturn \"\", fmt.Errorf(\"获取 SHA256SUMS: HTTP %d\", resp.StatusCode)\n\t}\n\tsc := bufio.NewScanner(resp.Body)\n\tfor sc.Scan() {\n\t\t// 格式：<hash>␠␠<filename>\n\t\tfields := strings.Fields(sc.Text())\n\t\tif len(fields) == 2 && fields[1] == asset {","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/xpzouying/xiaohongshu-mcp/blob/332d196854a9eac0d2b8c2c0e3d0cc43139d724c/browser/browser_download.go#L127-L163","documentation":"verifySHA256 的完整性校验失败分支：计算出的归档文件实际 SHA256 与 SHA256SUMS 中该 asset 的期望哈希不一致（不区分大小写比较）。说明下载产物被损坏或被篡改/替换，拒绝使用该文件。","triggerScenarios":"verifySHA256 → 比较失败：下载被中间层（代理/镜像）篡改或返回了错误页面、下载中断产生截断文件、SHA256SUMS 与资产版本不匹配、磁盘位损坏。","commonSituations":"企业代理做了内容改写/注入；CDN 上资产与 SUMS 版本不同步；断点续传拼接出损坏文件。","solutions":["删除缓存的压缩包重新下载，再观察哈希是否一致","检查代理是否改写响应内容，尝试直连或换网络","确认资产 URL 与 SHA256SUMS 来自同一版本","用 sha256sum 手动比对期望/实际值定位差异"],"exampleFix":"// before\n// 缓存中有损坏文件\nbin, err := browser.EnsureBrowser() // SHA256 不匹配\n// after\nos.Remove(filepath.Join(cacheDir, asset)) // 删除损坏文件\nbin, err := browser.EnsureBrowser()","handlingStrategy":"retry","validationCode":"// 下载后本地快速校验\n// expected=$(curl -s $BASE/SHA256SUMS | grep <asset> | awk '{print $1}')\n// actual=$(sha256sum <archive> | awk '{print $1}')\n// [ \"$expected\" = \"$actual\" ] || 删除文件重试","typeGuard":null,"tryCatchPattern":"bin, err := browser.EnsureBrowser()\nif err != nil && strings.Contains(err.Error(), \"SHA256 不匹配\") {\n\tos.RemoveAll(cacheDir) // 清理被篡改/损坏的下载\n\tbin, err = browser.EnsureBrowser()\n\tif err != nil { return fmt.Errorf(\"重下载后仍校验失败: %w\", err) }\n}","preventionTips":["不要通过会改写内容的代理下载资产","资产更新时同步更新 SHA256SUMS","断点续传后务必整体校验哈希","对比错误信息中的期望/实际哈希快速定位损坏来源"],"tags":["checksum","sha256","integrity","security"],"backgroundTag":"sha256-mismatch","analyzedSha":"332d196854a9eac0d2b8c2c0e3d0cc43139d724c","analyzedAt":"2026-09-05T22:22:55.988Z","contentChangedAt":"2026-09-05T22:22:55.988Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}