{"record":{"id":"3cf7feb657b4d5a6","repo":"tinyhumansai/openhuman","slug":"openhuman-checksum-mismatch-n-expected-expe","errorCode":null,"errorMessage":"[openhuman] Checksum mismatch!\\n  expected: ${expectedChecksum}\\n  got:      ${actualChecksum}","messagePattern":"\\[openhuman\\] Checksum mismatch!\\\\n  expected: (.+?)\\\\n  got:      (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"critical","filePath":"packages/npm/install.js","lineNumber":122,"sourceCode":"  if (fs.existsSync(binDest)) {\n    console.log('[openhuman] Binary already installed, skipping download.');\n    return;\n  }\n\n  console.log(`[openhuman] Downloading v${VERSION} for ${target}...`);\n\n  // Download checksum first (small)\n  const checksumData = await httpsGet(`${baseUrl}/${checksumFile}`);\n  const expectedChecksum = checksumData.toString('utf8').trim().split(/\\s+/)[0];\n\n  // Download binary archive\n  await downloadFile(`${baseUrl}/${tarball}`, tmpTarball);\n\n  // Verify checksum\n  const actualChecksum = sha256hex(tmpTarball);\n  if (expectedChecksum !== actualChecksum) {\n    fs.rmSync(tmpTarball, { force: true });\n    throw new Error(\n      `[openhuman] Checksum mismatch!\\n  expected: ${expectedChecksum}\\n  got:      ${actualChecksum}`\n    );\n  }\n  console.log('[openhuman] Checksum verified.');\n\n  // Extract — use execFileSync (no shell interpolation) so paths with spaces\n  // or shell metacharacters in `tmpTarball` / `binDir` can't be injected.\n  if (isWin) {\n    // PowerShell is available on Windows runners\n    execFileSync(\n      'powershell',\n      [\n        '-NoProfile',\n        '-NonInteractive',\n        '-Command',\n        `Expand-Archive -Path $env:TC_SRC -DestinationPath $env:TC_DEST -Force`,\n      ],\n      { stdio: 'inherit', env: { ...process.env, TC_SRC: tmpTarball, TC_DEST: binDir } }","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/tinyhumansai/openhuman/blob/a221052e0df5b1f7598fceba7329fd1af95d6699/packages/npm/install.js#L104-L140","documentation":"Integrity gate of the npm installer: the sha256 of the downloaded core tarball must equal the first whitespace-separated token of the published checksum file. A mismatch means the bytes on disk are not the bytes the release signed off, so the bad archive is deleted and install aborts.","triggerScenarios":"Truncated or corrupted download (dropped connection, disk full mid-write); TLS-inspection proxy or antivirus rewriting bytes; CDN/version skew where the checksum file and tarball resolve to different releases.","commonSituations":"Corporate proxies mangling binaries; flaky CI network; a partially propagated release where checksums were updated before artifacts.","solutions":["Re-run the install after clearing cached artifacts (npm cache clean --force, remove the tmp tarball dir) so a fresh download re-verifies","Retry from a network without TLS-intercepting proxies and with AV live-scanning disabled for the download","If it persists, compare the two hex digests in the message against the published release and file an issue — never bypass the check"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Before trusting a downloaded archive, verify it yourself:\nconst { createHash } = require('crypto');\nconst actual = createHash('sha256').update(fs.readFileSync(tarball)).digest('hex');\nif (actual !== expected) { fs.rmSync(tarball, { force: true }); /* re-download */ }","typeGuard":null,"tryCatchPattern":"try {\n  await install();\n} catch (e) {\n  if (String(e.message).includes('Checksum mismatch')) {\n    // corrupted transfer: clear cache and retry once with a clean download\n    await cleanTmpAndRetry();\n    return;\n  }\n  throw e;\n}","preventionTips":["Never install with checksum verification disabled (--ignore-scripts bypasses it entirely)","Exclude package download dirs from AV live-scanning and TLS-inspecting proxies","On mismatch, always delete the archive and re-download — do not reuse the bad bytes"],"tags":["npm","install","checksum","integrity","security"],"backgroundTag":null,"analyzedSha":"a221052e0df5b1f7598fceba7329fd1af95d6699","analyzedAt":"2026-08-16T12:47:06.542Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}