{"record":{"id":"3c961e8df95f82b6","repo":"herdrdev/herdr","slug":"downloaded-remote-asset-checksum-verification-fail","errorCode":null,"errorMessage":"downloaded remote asset checksum verification failed: {err}","messagePattern":"downloaded remote asset checksum verification failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/remote/attach.rs","lineNumber":1449,"sourceCode":"    let asset_key = platform.asset_key();\n    let asset = remote_release_asset(&asset_key)?;\n\n    let dir = private_download_dir(&asset_key)?;\n    let path = dir.join(\"herdr.tmp\");\n    let status = crate::noninteractive_process::curl_command()\n        .args([\"-sfL\", \"--max-time\", \"120\", \"-o\"])\n        .arg(&path)\n        .arg(&asset.url)\n        .status()\n        .map_err(|err| io::Error::new(err.kind(), format!(\"download failed: {err}\")))?;\n    if !status.success() {\n        let _ = fs::remove_dir_all(&dir);\n        return Err(io::Error::other(\"download failed\"));\n    }\n    if let Some(expected) = &asset.sha256 {\n        if let Err(err) = crate::checksum::verify_sha256(&path, expected) {\n            let _ = fs::remove_dir_all(&dir);\n            return Err(io::Error::new(\n                err.kind(),\n                format!(\"downloaded remote asset checksum verification failed: {err}\"),\n            ));\n        }\n    }\n\n    Ok(InstallSource::temporary(path, dir))\n}\n\nfn fetch_remote_manifest(url: &str) -> io::Result<Vec<u8>> {\n    let output = crate::noninteractive_process::curl_command()\n        .args([\n            \"-sfL\",\n            \"--retry\",\n            \"3\",\n            \"--connect-timeout\",\n            \"10\",\n            \"--max-time\",","sourceCodeStart":1431,"sourceCodeEnd":1467,"githubUrl":"https://github.com/herdrdev/herdr/blob/f457cff4f2648eee85d176f8a41861241d4e8428/src/remote/attach.rs#L1431-L1467","documentation":"After downloading the remote asset, herdr verifies its sha256 against the expected checksum from the release manifest. A mismatch or unreadable file causes verify_sha256 to fail and this error (preserving the verifier's error kind) is returned; the temp directory is removed.","triggerScenarios":"Corrupted or truncated download (proxy tampering, interrupted transfer), a release manifest whose sha256 does not match the actual asset, or the downloaded file becoming unreadable before hashing.","commonSituations":"Corporate proxies/MITM rewriting binaries, stale cached manifest pointing at re-published assets, disk-full truncation during download.","solutions":["Retry the download (transient corruption is the most common cause)","Verify network path integrity: disable suspicious proxies or check MITM behavior","Clear any local manifest/asset cache and re-resolve the latest release","Manually compare sha256 of the URL against the published checksum to detect a re-published asset"],"exampleFix":"# manual verification\nurl=https://github.com/herdrdev/herdr/releases/latest/download/herdr-linux-x86_64\ncurl -sfL \"$url\" | sha256sum   # compare with manifest value","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"for attempt in 0..3 {\n    match download_and_verify(asset) {\n        Err(e) if e.to_string().contains(\"checksum\") if attempt < 2 => continue,\n        r => break r,\n    }\n}?","preventionTips":["Retry downloads on checksum failure — corruption is usually transient","Avoid proxies that rewrite binary payloads","Pin to known-good release tags when reproducibility matters"],"tags":["checksum","sha256","download","integrity","rust"],"backgroundTag":"checksum-verification-failed","analyzedSha":"f457cff4f2648eee85d176f8a41861241d4e8428","analyzedAt":"2026-08-28T15:41:09.197Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}