{"record":{"id":"42797a5ec9018cc7","repo":"rust-lang/rust","slug":"failed-verification","errorCode":null,"errorMessage":"failed verification","messagePattern":"failed verification","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"critical","filePath":"src/bootstrap/bootstrap.py","lineNumber":82,"sourceCode":"                ).format(url)\n            )\n        sha256 = checksums[url]\n        if os.path.exists(path):\n            if verify(path, sha256, False):\n                if verbose > 0:\n                    eprint(\"using already-download file\", path)\n                return\n            else:\n                if verbose > 0:\n                    eprint(\n                        \"ignoring already-download file\",\n                        path,\n                        \"due to failed verification\",\n                    )\n                os.unlink(path)\n        download(temp_path, \"{}/{}\".format(base, url), True, verbose)\n        if not verify(temp_path, sha256, verbose):\n            raise RuntimeError(\"failed verification\")\n        if verbose > 0:\n            eprint(\"moving {} to {}\".format(temp_path, path))\n        shutil.move(temp_path, path)\n    finally:\n        if os.path.isfile(temp_path):\n            if verbose > 0:\n                eprint(\"removing\", temp_path)\n            os.unlink(temp_path)\n\n\ndef curl_version():\n    m = re.match(bytes(\"^curl ([0-9]+)\\\\.([0-9]+)\", \"utf8\"), require([\"curl\", \"-V\"]))\n    if m is None:\n        return (0, 0)\n    return (int(m[1]), int(m[2]))\n\n\ndef download(path, url, probably_big, verbose):","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/rust-lang/rust/blob/7088e4b63a9516ebfbfe2ab2d999cf01a528ac14/src/bootstrap/bootstrap.py#L64-L100","documentation":"Raised by get() in bootstrap.py at line 82 after a freshly downloaded stage0 artifact fails SHA-256 verification. The function downloads the file to a temp path, calls verify(temp_path, sha256, verbose), and if it returns false, raises RuntimeError('failed verification'). This is a supply-chain integrity guard: the downloaded binary does not match the pinned checksum from src/stage0.","triggerScenarios":"get() downloads the artifact to temp_path at line 80, then verify() at line 81 returns False. verify() computes the SHA-256 of the file and compares it to the checksums[url] value. A mismatch means the downloaded bytes differ from the known-good hash. Triggers: corrupted download (network error, truncation), a MITM or compromised mirror, or an out-of-sync stage0 file whose checksums don't match what the server actually serves.","commonSituations":"Unstable network causing a truncated download; a corporate proxy that modifies the download; the stage0 file was edited to point at a different server/commit but checksums weren't updated; or a CDN caching issue serving a stale or wrong artifact.","solutions":["Delete the partial download in the build directory and re-run x.py to fetch a fresh copy.","Verify network connectivity and retry; if behind a proxy, bypass it for static.rust-lang.org.","Ensure src/stage0 matches the commit of the rust-lang/rust checkout (git checkout/restore src/stage0).","Manually download the artifact and compute its sha256 to compare against the stage0 checksum, then investigate the discrepancy."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"# Pre-verify an existing file's checksum before re-downloading\nimport hashlib\ndef verify_file(path, expected_sha256):\n    h = hashlib.sha256()\n    with open(path, 'rb') as f:\n        for chunk in iter(lambda: f.read(8192), b''):\n            h.update(chunk)\n    return h.hexdigest() == expected_sha256","typeGuard":null,"tryCatchPattern":"import time\nfor attempt in range(3):\n    try:\n        get(base, url, path, checksums, verbose)\n        break\n    except RuntimeError as e:\n        if 'failed verification' in str(e) and attempt < 2:\n            print(f'Checksum failed, retrying download ({attempt+1}/3)...')\n            time.sleep(2 ** attempt)\n            continue\n        raise","preventionTips":["Use a stable network connection or mirror for stage0 downloads.","If downloads frequently corrupt, configure a local HTTP cache or proxy.","Keep the src/stage0 file synchronized with the exact commit of the checkout.","Avoid interrupting bootstrap mid-download; clean partial files before retrying."],"tags":["bootstrap","rustc","stage0","checksum","verification","integrity","python"],"backgroundTag":null,"analyzedSha":"7088e4b63a9516ebfbfe2ab2d999cf01a528ac14","analyzedAt":"2026-08-10T14:17:03.603Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}