{"record":{"id":"2b08165424b0a694","repo":"coreybutler/nvm-windows","slug":"error-failed-to-download-checksum-v","errorCode":null,"errorMessage":"error: failed to download checksum: %v\n","messagePattern":"error: failed to download checksum: (.+?)\n","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/upgrade/upgrade.go","lineNumber":399,"sourceCode":"\t}\n\tdefer os.RemoveAll(tmp)\n\n\t// Download the new app\n\tsource := update.SourceURL\n\t// source := fmt.Sprintf(update.SourceURL, update.Version)\n\t// source := fmt.Sprintf(update.SourceURL, \"1.1.11\") // testing\n\tbody, err := get(source)\n\tif err != nil {\n\t\tstatus <- Status{Err: fmt.Errorf(\"error: failed to download new version: %v\\n\", err)}\n\t}\n\n\tos.WriteFile(filepath.Join(tmp, \"assets.zip\"), body, os.ModePerm)\n\tos.Mkdir(filepath.Join(tmp, \"assets\"), os.ModePerm)\n\n\tsource = source + \".checksum.txt\"\n\tbody, err = get(source)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error: failed to download checksum: %v\\n\", err)\n\t}\n\n\tos.WriteFile(filepath.Join(tmp, \"assets.zip.checksum.txt\"), body, os.ModePerm)\n\n\tfilePath := filepath.Join(tmp, \"assets.zip\")                  // path to the file you want to validate\n\tchecksumFile := filepath.Join(tmp, \"assets.zip.checksum.txt\") // path to the checksum file\n\n\t// Step 1: Compute the MD5 checksum of the file\n\tstatus <- Status{Text: \"verifying checksum...\"}\n\tcomputedChecksum, err := computeMD5Checksum(filePath)\n\tif err != nil {\n\t\tstatus <- Status{Err: fmt.Errorf(\"Error computing checksum: %v\", err)}\n\t}\n\n\t// Step 2: Read the checksum from the .checksum.txt file\n\tstoredChecksum, err := readChecksumFromFile(checksumFile)\n\tif err != nil {\n\t\tstatus <- Status{Err: err}","sourceCodeStart":381,"sourceCodeEnd":417,"githubUrl":"https://github.com/coreybutler/nvm-windows/blob/5b18223ca19ff50d707f35410dbc6bd440a9f74d/src/upgrade/upgrade.go#L381-L417","documentation":"After downloading the update zip, nvm-windows fetches its sibling checksum file (SourceURL + \".checksum.txt\") to validate the download. This error means that second HTTP GET failed. It is returned directly (unlike error 40), aborting the upgrade before extraction. Causes range from transport failures to the checksum file simply not being published next to the asset.","triggerScenarios":"SourceURL resolves but <SourceURL>.checksum.txt does not (404) — maintainer published the zip without the checksum sidecar; proxy/TLS interception that allowed the first request but blocked the .txt; connection dropped between the two sequential GETs; mirror that mirrors zips but not checksum files.","commonSituations":"Using a third-party mirror of nvm-windows releases that omits checksum files; upgrading while network is flaky; GitHub raw content blocked by policy while release assets are allowed.","solutions":["curl -I <SourceURL>.checksum.txt to confirm the checksum sidecar exists and returns 200.","If a mirror is configured (NVM_NVM_HOME mirror settings), switch back to the official GitHub release URL or pick a mirror that also hosts checksums.","Retry the upgrade — a transient failure of the second request aborts safely before any files are replaced.","If checksums are genuinely unavailable upstream, wait for/package a corrected release rather than skipping validation."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Check the checksum sidecar exists before running the upgrade\nresp, err := http.Head(update.SourceURL + \".checksum.txt\")\nif err != nil || resp.StatusCode != http.StatusOK {\n    fmt.Println(\"checksum file missing at\", update.SourceURL+\".checksum.txt\", \"— do not upgrade\")\n}","typeGuard":null,"tryCatchPattern":"Catch the returned error at the upgrade entrypoint; abort cleanly (installation is untouched at this stage) and surface the URL so the user can verify manually.","preventionTips":["Use official GitHub release URLs; third-party mirrors frequently omit .checksum.txt sidecars.","Never bypass the checksum step even when the file is missing — that is the integrity gate."],"tags":["network","upgrade","checksum","nvm-windows"],"backgroundTag":null,"analyzedSha":"5b18223ca19ff50d707f35410dbc6bd440a9f74d","analyzedAt":"2026-08-15T10:06:51.428Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}