{"record":{"id":"2f76a428d74da815","repo":"abiosoft/colima","slug":"error-validating-sha-sum-for-s-w","errorCode":null,"errorMessage":"error validating SHA sum for '%s': %w","messagePattern":"error validating SHA sum for '(.+?)': %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/downloader/download.go","lineNumber":135,"sourceCode":"func (d downloader) downloadFile(r Request) (err error) {\n\tcacheDownloadingFilename := d.cacheDownloadingFileName(r.URL)\n\n\t// create cache directory\n\tcacheDir := filepath.Dir(cacheDownloadingFilename)\n\tif err := os.MkdirAll(cacheDir, 0755); err != nil {\n\t\treturn fmt.Errorf(\"error preparing cache dir: %w\", err)\n\t}\n\n\tif err := fileDownloader.Download(r, cacheDownloadingFilename); err != nil {\n\t\treturn err\n\t}\n\n\t// validate download if SHA is present\n\tif r.SHA != nil {\n\t\tif err := r.SHA.validateDownload(r.URL, cacheDownloadingFilename); err != nil {\n\t\t\t// move file to allow subsequent re-download\n\t\t\t_ = os.Rename(cacheDownloadingFilename, cacheDownloadingFilename+\".invalid\")\n\t\t\treturn fmt.Errorf(\"error validating SHA sum for '%s': %w\", path.Base(r.URL), err)\n\t\t}\n\t}\n\n\t// move completed download to final location\n\tif err := os.Rename(cacheDownloadingFilename, CacheFilename(r.URL)); err != nil {\n\t\treturn fmt.Errorf(\"error finalizing download: %w\", err)\n\t}\n\n\treturn nil\n}\n\nfunc (d downloader) saveResumeInfo(url, etag string, bytesWritten int64) {\n\tinfo := ResumeInfo{ETag: etag, BytesWritten: bytesWritten}\n\tdata, _ := json.Marshal(info)\n\t_ = os.WriteFile(d.resumeInfoPath(url), data, 0644)\n}\n\nfunc (d downloader) hasCache(url string) bool {","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/abiosoft/colima/blob/c3a5f9184d83a197184f897a9f07eb3c01b3bc88/util/downloader/download.go#L117-L153","documentation":"The file downloaded successfully but r.SHA.validateDownload failed, so the artifact is not trusted: the .downloading file is renamed to .invalid to force a re-download on the next attempt. The wrapped error is most often *SHAValidationError (digest mismatch), but can also be the unsupported-size error (SHA.Size not 256/512), an open/read failure on the downloaded file, a sha-file fetch/parse failure (errors 273-275), or the 'one of Digest or URL must be set' misuse error.","triggerScenarios":"Request.SHA is non-nil and validation fails: computed digest differs from the expected one (SHAValidationError); SHA.Size is not 256/512; the checksum URL could not be fetched or parsed; neither SHA.Digest nor SHA.URL was set.","commonSituations":"Upstream republished the artifact without updating the checksum file (or vice versa); download truncated by a proxy; mirror serves a different file than the checksum source; SHA configured with the wrong Size field.","solutions":["Clear the cached entry (final name plus the .invalid file via downloader.CacheFilename(url)) and retry to force a fresh download","Verify manually: shasum -a 256 <file> against the checksum file contents","Check SHA.Size is 256 or 512 and that the checksum file actually contains an entry for the artifact basename","If upstream's checksum is stale or wrong, report it there; clear local cache after it is fixed"],"exampleFix":"// before\ncacheFile, err := downloader.Download(host, req)\n// after: on SHA failure, clear cache and re-download once\ncacheFile, err := downloader.Download(host, req)\nif err != nil {\n    var shaErr *downloader.SHAValidationError\n    if errors.As(err, &shaErr) {\n        cache := downloader.CacheFilename(req.URL)\n        _ = os.Remove(cache)\n        _ = os.Remove(cache + \".invalid\")\n        cacheFile, err = downloader.Download(host, req)\n    }\n}\nif err != nil {\n    return err\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":"func isSHAValidation(err error) bool {\n    var e *downloader.SHAValidationError\n    return errors.As(err, &e) || errors.Is(err, downloader.ErrSHAValidation)\n}","tryCatchPattern":"cacheFile, err := downloader.Download(host, req)\nif err != nil && isSHAValidation(err) {\n    cache := downloader.CacheFilename(req.URL)\n    _ = os.Remove(cache)\n    _ = os.Remove(cache + \".invalid\")\n    cacheFile, err = downloader.Download(host, req) // one clean re-download\n}\nif err != nil {\n    return err // non-SHA errors and persistent mismatches propagate\n}","preventionTips":["Always set SHA.Size explicitly to 256 or 512 — the zero value fails validation","Pin SHA.Digest when reproducibility matters instead of relying on a mutable checksum URL","Never silence a repeated SHA mismatch — it means upstream content differs from upstream checksums"],"tags":["sha","integrity","download","cache"],"backgroundTag":null,"analyzedSha":"c3a5f9184d83a197184f897a9f07eb3c01b3bc88","analyzedAt":"2026-08-15T18:58:08.334Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}