{"record":{"id":"1de8a27502aa56f6","repo":"jamiepine/voicebox","slug":"label-integrity-check-failed-expected-expected","errorCode":null,"errorMessage":"{label} integrity check failed: expected {expected_sha[:16]}..., got {actual[:16]}...","messagePattern":"(.+?) integrity check failed: expected (.+?)\\.\\.\\., got (.+?)\\.\\.\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"critical","filePath":"backend/services/cuda.py","lineNumber":236,"sourceCode":"        # Verify integrity\n        if expected_sha:\n            progress.update_progress(\n                PROGRESS_KEY,\n                current=progress_offset + downloaded,\n                total=total_size,\n                filename=f\"Verifying {label}...\",\n                status=\"downloading\",\n            )\n            sha256 = hashlib.sha256()\n            with open(temp_path, \"rb\") as f:\n                while True:\n                    data = f.read(1024 * 1024)\n                    if not data:\n                        break\n                    sha256.update(data)\n            actual = sha256.hexdigest()\n            if actual != expected_sha:\n                raise ValueError(\n                    f\"{label} integrity check failed: expected {expected_sha[:16]}..., got {actual[:16]}...\"\n                )\n            logger.info(f\"{label}: integrity verified\")\n\n        # Extract (use data filter for path traversal protection on Python 3.12+)\n        progress.update_progress(\n            PROGRESS_KEY,\n            current=progress_offset + downloaded,\n            total=total_size,\n            filename=f\"Extracting {label}...\",\n            status=\"downloading\",\n        )\n        with tarfile.open(temp_path, \"r:gz\") as tar:\n            if sys.version_info >= (3, 12):\n                tar.extractall(path=dest_dir, filter=\"data\")\n            else:\n                tar.extractall(path=dest_dir)\n","sourceCodeStart":218,"sourceCodeEnd":254,"githubUrl":"https://github.com/jamiepine/voicebox/blob/51f49dea198384b4eb6087b72c17057c6eb1c1cd/backend/services/cuda.py#L218-L254","documentation":"After streaming the archive to a temp file, _download_and_extract_archive() SHA-256 hashes it and compares to expected_sha (parsed from the .sha256 file). On mismatch it raises ValueError; the outer finally always deletes the temp file, so a failed archive is never extracted. This catches truncated downloads, on-disk corruption, and tampered/compromised assets.","triggerScenarios":"Network drop mid-stream truncating the multi-hundred-MB CUDA-libs archive, disk write corruption, a MITM/compromised CDN serving a different asset, or a release where the archive and .sha256 were uploaded from different builds.","commonSituations":"Unstable connection dropping a large transfer; antivirus/security tool rewriting the stream in flight; mismatched archive/checksum pair published to a release.","solutions":["Re-run download_cuda_binary() on a stable link (the finally block deletes the temp; a crashed process usually leaves no partial, but check for stray .download-*.tmp).","Manually compare the published .sha256 against the GitHub UI to rule out a mismatched release asset.","If it reproduces consistently, the published archive/checksum pair is likely broken — file an issue rather than force-extracting."],"exampleFix":"# before\nif actual != expected_sha:\n    raise ValueError(f\"{label} integrity check failed: ...\")\n\n# after — clear partial state and re-raise (do NOT extract)\nif actual != expected_sha:\n    temp_path.unlink(missing_ok=True)\n    raise ValueError(f\"{label} integrity check failed: ...\")","handlingStrategy":"retry","validationCode":"import hashlib\nfrom pathlib import Path\n\ndef local_sha256(path: Path) -> str:\n    h = hashlib.sha256()\n    with open(path, \"rb\") as f:\n        for chunk in iter(lambda: f.read(1 << 20), b\"\"):\n            h.update(chunk)\n    return h.hexdigest()\n# compare local_sha256(temp) against the published checksum before trusting","typeGuard":null,"tryCatchPattern":"for attempt in range(2):\n    try:\n        await download_cuda_binary(version)\n        break\n    except ValueError as e:\n        if \"integrity check failed\" in str(e) and attempt == 0:\n            await delete_cuda_binary()  # clear bad state, then retry once\n            continue\n        raise","preventionTips":["Never bypass the integrity check to 'fix' this error — investigate the root cause.","Ensure stable bandwidth for the large CUDA-libs archive.","If it reproduces consistently, suspect a mismatched published archive/checksum pair and file an issue."],"tags":["security","integrity","cuda","download","sha256"],"backgroundTag":null,"analyzedSha":"51f49dea198384b4eb6087b72c17057c6eb1c1cd","analyzedAt":"2026-08-12T16:51:42.824Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}