{"record":{"id":"12b4b579549badee","repo":"dagger/dagger","slug":"downloaded-cli-binary-checksum-actual-hash-doe","errorCode":null,"errorMessage":"Downloaded CLI binary checksum ({actual_hash}) does not match expected checksum ({expected_hash})","messagePattern":"Downloaded CLI binary checksum \\((.+?)\\) does not match expected checksum \\((.+?)\\)","errorType":"exception","errorClass":"DownloadError","httpStatus":null,"severity":"critical","filePath":"sdk/python/src/dagger/provisioning/_download.py","lineNumber":211,"sourceCode":"        except httpx.HTTPError as e:\n            msg = f\"Failed to download checksums from {self.checksum_url}: {e}\"\n            raise DownloadError(msg) from e\n\n        self.progress.update_sync(\"Downloading dagger CLI\")\n\n        with TempFile(f\"temp-{self.CLI_BIN_PREFIX}\", self.cache_dir) as tmp_bin:\n            try:\n                actual_hash = self.extract_cli_archive(tmp_bin)\n            except httpx.HTTPError as e:\n                msg = f\"Failed to download archive from {self.archive_url}: {e}\"\n                raise DownloadError(msg) from e\n\n            if actual_hash != expected_hash:\n                msg = (\n                    f\"Downloaded CLI binary checksum ({actual_hash}) \"\n                    f\"does not match expected checksum ({expected_hash})\"\n                )\n                raise DownloadError(msg)\n\n        tmp_bin_path = Path(tmp_bin.name)\n        tmp_bin_path.chmod(0o700)\n        return tmp_bin_path.rename(path)\n\n    def expected_checksum(self) -> str:\n        archive_name = self.archive_name\n        with httpx.stream(\"GET\", self.checksum_url, follow_redirects=True) as r:\n            try:\n                r.raise_for_status()\n            except httpx.HTTPStatusError as e:\n                if self.is_cli_release_unavailable(e.response.status_code):\n                    msg = f\"Failed to download checksums from {self.checksum_url}: {e}\"\n                    raise CLIReleaseUnavailableError(msg) from e\n                raise\n            for line in r.iter_lines():\n                checksum, filename = line.split()\n                if filename == archive_name:","sourceCodeStart":193,"sourceCodeEnd":229,"githubUrl":"https://github.com/dagger/dagger/blob/82ba2681dbe30d3547a1dc50ea495900ab5b6047/sdk/python/src/dagger/provisioning/_download.py#L193-L229","documentation":"DownloadError raised when the SHA256 hash of the downloaded dagger CLI binary does not match the checksum published in the release checksums file. The library treats this as evidence of corruption or tampering and refuses to use the binary.","triggerScenarios":"_download compares actual_hash (hash of extracted CLI) against expected_checksum(); any mismatch raises. Caused by corrupted downloads, disk issues, or a tampered/mirror-substituted binary.","commonSituations":"Interrupted download that still passed streaming; MITM proxies re-writing content; caching proxies serving stale/partial archives; corrupted cache_dir contents on disk.","solutions":["Delete the provisioning cache directory (dagger's cache_dir holding temp downloads) and retry.","Retry the download — a fresh attempt usually produces a matching checksum.","Check for TLS-intercepting proxies/AV software modifying binary downloads and add an exclusion.","Verify you are on an official build; if pinning a custom version, ensure the checksums file matches your archive.","Pre-install a verified dagger CLI on PATH to skip download verification entirely."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"# clear corrupted cache before running\ncache = Path.home() / \".cache\" / \"dagger\"  # adjust to your platform cache dir\nif cache.exists() and not all((cache).glob(\"cli-*\")):\n    shutil.rmtree(cache, ignore_errors=True)","typeGuard":null,"tryCatchPattern":"from dagger.provisioning import DownloadError\ntry:\n    async with dagger.Connection() as client:\n        ...\nexcept DownloadError as e:\n    if \"checksum\" in str(e):\n        clear_download_cache()  # purge and re-download\n        raise","preventionTips":["Never disable or proxy TLS to dl.dagger.io (no MITM inspection of binaries).","Exclude the dagger cache dir from AV/quota-affected disks.","Verify available disk space before provisioning.","Install the CLI from a trusted package manager instead of runtime download in sensitive environments."],"tags":["security","checksum","python","provisioning"],"backgroundTag":"checksum-mismatch","analyzedSha":"82ba2681dbe30d3547a1dc50ea495900ab5b6047","analyzedAt":"2026-09-05T07:21:37.930Z","contentChangedAt":"2026-09-05T07:21:37.930Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}