{"record":{"id":"3a3c74f99151cf7b","repo":"BoundaryML/baml","slug":"sha256-mismatch-for-url-expected-expected-got-got","errorCode":null,"errorMessage":"sha256 mismatch for {url}: expected {expected}, got {got}","messagePattern":"sha256 mismatch for (.+?): expected (.+?), got (.+?)","errorType":"exception","errorClass":"FetchError","httpStatus":null,"severity":"critical","filePath":"baml_language/crates/baml_release/src/lib.rs","lineNumber":91,"sourceCode":"    }\n}\n\n#[derive(Debug, thiserror::Error)]\npub enum FetchError {\n    #[error(\"network error fetching {url}: {source}\")]\n    Network { url: String, source: reqwest::Error },\n    #[error(\"HTTP {status} fetching {url}\")]\n    HttpStatus {\n        url: String,\n        status: reqwest::StatusCode,\n    },\n    #[error(\"manifest 404 for version {version} (not released yet?)\")]\n    ManifestNotFound { version: String },\n    #[error(\"manifest schema {got} not supported (max {max}); run `baml self-update`\")]\n    ManifestSchemaTooNew { got: u32, max: u32 },\n    #[error(\"target {target} not built for version {version}\")]\n    TargetNotInManifest { target: String, version: String },\n    #[error(\"sha256 mismatch for {url}: expected {expected}, got {got}\")]\n    ChecksumMismatch {\n        url: String,\n        expected: String,\n        got: String,\n    },\n    #[error(\"archive missing expected binary {name}\")]\n    BinaryNotInArchive { name: String },\n    #[error(\"archive contains unsafe path {path}\")]\n    UnsafeArchivePath { path: String },\n    #[error(\"disk error: {0}\")]\n    Io(#[from] std::io::Error),\n    #[error(\"zip archive error: {0}\")]\n    Zip(#[from] zip::result::ZipError),\n}\n\n#[derive(Debug, Clone)]\npub struct Fetcher {\n    pub spec: ReleaseSpec,","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/BoundaryML/baml/blob/bd85ce9dee1463ff04d27efd20531013a4ff46c1/baml_language/crates/baml_release/src/lib.rs#L73-L109","documentation":"FetchError::ChecksumMismatch is thrown by baml_release when the sha256 of the downloaded artifact does not match the checksum recorded in the release manifest. This is a security/integrity guard against corrupted or tampered downloads; the error reports the URL, expected hash, and actual hash.","triggerScenarios":"Downloading a release archive whose computed sha256 differs from the manifest — interrupted/corrupted downloads, proxies rewriting content, or a mismatch between the manifest and the actually published artifact.","commonSituations":"Flaky corporate proxies or TLS-intercepting middleboxes altering the payload, partially cached downloads on a bad CDN node, manually edited manifest/artifacts, or installing through a custom mirror with stale artifacts.","solutions":["Retry the download to rule out transient corruption","Clear any download/proxy cache and retry via a direct connection","Compare the expected/got hashes; if persistent, verify the artifact on the release server","Check whether a mirror or proxy is modifying the response (bypass HTTPS_PROXY)","Report the mismatch if the official artifact genuinely disagrees with its manifest"],"exampleFix":"# before (cached corrupt artifact kept being reused)\n$ baml self-update\nsha256 mismatch for https://releases.baml.com/.../cli.zip: expected ab12..., got ff00...\n# after\n$ rm -rf ~/.cache/baml/downloads\n$ baml self-update","handlingStrategy":"retry","validationCode":"// verify checksum yourself before installing\nlet sum = sha256_hex(download(&url)?);\nif sum != manifest.checksum {\n    eprintln!(\"pre-check failed: expected {} got {}\", manifest.checksum, sum);\n}","typeGuard":"fn is_checksum_err(e: &FetchError) -> bool {\n    matches!(e, FetchError::ChecksumMismatch { .. })\n}","tryCatchPattern":"match install(v) {\n    Err(FetchError::ChecksumMismatch { url, expected, got }) => {\n        warn!(\"corrupt download from {url}; purging cache and retrying\");\n        purge_download_cache();\n        retry_once_or_fail()\n    }\n    other => other,\n}","preventionTips":["Always fetch artifacts over HTTPS from the official host","Purge cached downloads after a failed install","Watch for TLS-intercepting proxies altering payloads","Treat persistent mismatches as a security incident and report them"],"tags":["security","checksum","download"],"backgroundTag":"checksum-mismatch","analyzedSha":"bd85ce9dee1463ff04d27efd20531013a4ff46c1","analyzedAt":"2026-09-12T03:38:25.718Z","contentChangedAt":"2026-09-12T03:38:25.718Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}