{"record":{"id":"0e46f12de18f7f5d","repo":"router-for-me/CLIProxyAPI","slug":"checksum-mismatch-for-s","errorCode":null,"errorMessage":"checksum mismatch for %s","messagePattern":"checksum mismatch for (.+?)","errorType":"http","errorClass":null,"httpStatus":502,"severity":"critical","filePath":"internal/pluginstore/checksum.go","lineNumber":42,"sourceCode":"\t\t}\n\t\tif _, errDecode := hex.DecodeString(hash); errDecode != nil {\n\t\t\treturn nil, fmt.Errorf(\"line %d: invalid sha256: %w\", lineNumber+1, errDecode)\n\t\t}\n\t\tname := strings.TrimPrefix(strings.TrimSpace(fields[1]), \"*\")\n\t\tout[name] = hash\n\t}\n\treturn out, nil\n}\n\nfunc VerifyChecksum(name string, data []byte, checksums map[string]string) error {\n\texpected := strings.ToLower(strings.TrimSpace(checksums[name]))\n\tif expected == \"\" {\n\t\treturn fmt.Errorf(\"checksum for %s not found\", name)\n\t}\n\tactualBytes := sha256.Sum256(data)\n\tactual := hex.EncodeToString(actualBytes[:])\n\tif actual != expected {\n\t\treturn fmt.Errorf(\"checksum mismatch for %s\", name)\n\t}\n\treturn nil\n}\n","sourceCodeStart":24,"sourceCodeEnd":46,"githubUrl":"https://github.com/router-for-me/CLIProxyAPI/blob/78f0c4079e3e6273d65d03b5549cffc898703264/internal/pluginstore/checksum.go#L24-L46","documentation":"VerifyChecksum compares the SHA-256 hex digest of the supplied data bytes against the entry for `name` in the plugin store's checksums map. It throws 'checksum mismatch for %s' when the computed digest does not equal the (lower-cased, trimmed) expected value. This is an integrity guard: it fires after download when the file content has been corrupted, truncated, or replaced relative to what the store manifest declares.","triggerScenarios":"Calling VerifyChecksum(name, data, checksums) where sha256(data) != strings.ToLower(checksums[name]); typically invoked right after fetching a file (e.g. an index or artifact) listed in the plugin store checksum map. Partial downloads, proxy-injected error pages, or a stale checksum map paired with a newer file all trigger it.","commonSituations":"A CDN or corporate proxy returns an HTML error page instead of the binary; the plugin index was regenerated but the caller cached the old checksums map; a truncated download caused by a dropped connection; uppercase-vs-lowercase hex is already handled, so real content divergence is the usual cause.","solutions":["Re-download the data from the plugin store and retry VerifyChecksum — transient corruption is the most common cause.","Confirm the checksums map comes from the same index version as the downloaded file (refresh the store index).","If the checksum map is maintained locally, verify the digest independently (sha256sum on the file) and update the stale entry if the upstream legitimately changed.","Inspect the downloaded bytes (e.g. check for an HTML error page or zero length) to identify a proxy/network interceptor."],"exampleFix":"// before\ndata, _ := client.DownloadArtifact(ctx, artifact)\nif err := pluginstore.VerifyChecksum(artifact.Name, data, oldChecksums); err != nil {\n    return err // fails after index refresh\n}\n\n// after\nindex, err := client.FetchIndex(ctx) // refresh checksum map first\nif err != nil { return err }\ndata, err := client.DownloadArtifact(ctx, artifact)\nif err != nil { return err }\nif err := pluginstore.VerifyChecksum(artifact.Name, data, index.Checksums); err != nil {\n    return err\n}","handlingStrategy":"validation","validationCode":"if expected := strings.TrimSpace(checksums[name]); expected == \"\" {\n    return fmt.Errorf(\"no checksum entry for %q — refresh the plugin index\", name)\n}\n// pre-compute before verifying so a mismatch is diagnosable\nsum := sha256.Sum256(data)\nlog.Debugf(\"%s expected=%s actual=%s\", name, strings.ToLower(expected), hex.EncodeToString(sum[:]))","typeGuard":null,"tryCatchPattern":"if err := pluginstore.VerifyChecksum(name, data, checksums); err != nil {\n    if strings.Contains(err.Error(), \"checksum mismatch\") {\n        // do NOT install; re-download once, then surface as tamper/corruption\n    }\n    return err\n}","preventionTips":["Always fetch the checksums map and the file in the same index snapshot.","Never catch a checksum mismatch and continue installing — treat it as a security failure.","Retry at most once; a second mismatch means stale manifest or tampering."],"tags":["integrity","checksum","sha256","download","plugin-store"],"backgroundTag":null,"analyzedSha":"78f0c4079e3e6273d65d03b5549cffc898703264","analyzedAt":"2026-08-15T12:26:37.444Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}