{"record":{"id":"3b60ca3d6a38b535","repo":"siyuan-note/siyuan","slug":"verify-checksum-failed-download-install-package","errorCode":null,"errorMessage":"verify checksum failed, download install package [%s] checksum [%s] not equal to downloaded [%s] checksum [%s]","messagePattern":"verify checksum failed, download install package \\[(.+?)\\] checksum \\[(.+?)\\] not equal to downloaded \\[(.+?)\\] checksum \\[(.+?)\\]","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/model/updater.go","lineNumber":175,"sourceCode":"\tlogging.LogInfof(\"downloading install package [%s]\", pkgURL)\n\tclient := req.C().SetTLSHandshakeTimeout(7 * time.Second).SetTimeout(10 * time.Minute).DisableInsecureSkipVerify().SetUserAgent(util.UserAgent)\n\tcallback := func(info req.DownloadInfo) {\n\t\tprogress := fmt.Sprintf(\"%.2f%%\", float64(info.DownloadedSize)/float64(info.Response.ContentLength)*100.0)\n\t\t// logging.LogDebugf(\"downloading install package [%s %s]\", pkgURL, progress)\n\t\tutil.PushStatusBar(fmt.Sprintf(Conf.Language(133), progress))\n\t}\n\t_, err = client.R().SetOutputFile(savePath).SetDownloadCallbackWithInterval(callback, 1*time.Second).Get(pkgURL)\n\tif err != nil {\n\t\tlogging.LogErrorf(\"download install package [%s] failed: %s\", pkgURL, err)\n\t\tif removeErr := os.Remove(savePath); nil != removeErr && !os.IsNotExist(removeErr) {\n\t\t\tlogging.LogErrorf(\"remove incomplete install package [%s] failed: %s\", savePath, removeErr)\n\t\t}\n\t\treturn\n\t}\n\n\tlocalChecksum, _ := sha256Hash(savePath)\n\tif checksum != localChecksum {\n\t\terr = fmt.Errorf(\"verify checksum failed, download install package [%s] checksum [%s] not equal to downloaded [%s] checksum [%s]\", pkgURL, checksum, savePath, localChecksum)\n\t\tlogging.LogError(err.Error())\n\t\tif removeErr := os.Remove(savePath); nil != removeErr && !os.IsNotExist(removeErr) {\n\t\t\tlogging.LogErrorf(\"remove invalid install package [%s] failed: %s\", savePath, removeErr)\n\t\t}\n\t\treturn\n\t}\n\tlogging.LogInfof(\"downloaded install package [%s] to [%s]\", pkgURL, savePath)\n\tutil.PushStatusBar(Conf.Language(62))\n\treturn\n}\n\nfunc sha256Hash(filename string) (ret string, err error) {\n\tfile, err := os.Open(filename)\n\tif err != nil {\n\t\treturn\n\t}\n\tdefer file.Close()\n","sourceCodeStart":157,"sourceCodeEnd":193,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/model/updater.go#L157-L193","documentation":"Returned by downloadInstallPkg after a successful HTTP GET when the SHA-256 of the saved file does not equal the expected checksum. The download completed but the bytes on disk are not byte-identical to what the release signed off. The incomplete/invalid file is removed (os.Remove) and the error is logged via logging.LogError before returning. The message embeds the package URL, expected checksum, save path, and observed checksum for forensics.","triggerScenarios":"Network corruption or a proxy that altered bytes mid-transfer. The download was interrupted and the HTTP client wrote a partial body yet reported success. A mirror (b3log/liuyun/ghproxy) served a stale or wrong-version file with the same name. Disk write error or filesystem corruption truncated the file. A man-in-the-middle swapped the binary.","commonSituations":"Unstable connection that drops bytes without closing the socket. CDN cache poisoning where a mirror serves an older release's binary under the new version's filename. Disk full or antivirus locking the file mid-write on Windows. Corporate proxy re-encoding content.","solutions":["Retry the download; transient corruption usually resolves on the next attempt, and downloadInstallPkg already removed the bad file.","Try a different mirror by switching update channel or region (IsChinaCloud toggles mirror ordering).","Verify disk space and that no antivirus/backup tool is locking the install temp dir (util.TempDir/install).","If the observed checksum is stable across retries, suspect the mirror — download the package manually from GitHub and compare checksums."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Retry the download across mirror URLs; each bad file is auto-removed.\nvar lastErr error\nfor _, url := range downloadPkgURLs {\n    if err := downloadInstallPkg(url, checksum); err == nil {\n        return nil\n    } else {\n        lastErr = err\n    }\n}\nreturn lastErr","preventionTips":["Keep multiple mirror URLs in downloadPkgURLs so a corrupt mirror can be skipped.","Ensure adequate free disk space in util.TempDir/install before downloading.","Exclude the install temp dir from antivirus/backup scans on Windows to avoid write races."],"tags":["update","checksum","integrity","download","corruption","security"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}