{"record":{"id":"480947ddf49023f4","repo":"twpayne/chezmoi","slug":"ripemd-160-mismatch-expected-s-got-s","errorCode":null,"errorMessage":"RIPEMD-160 mismatch: expected %s, got %s","messagePattern":"RIPEMD-160 mismatch: expected (.+?), got (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/chezmoi/sourcestate.go","lineNumber":1712,"sourceCode":"\tif external.Checksum.MD5 != nil {\n\t\ts.warnFunc(\n\t\t\t\"%s: warning: insecure MD5 checksum will be removed, use a secure hash like SHA256 instead\\n\",\n\t\t\texternalRelPath,\n\t\t)\n\t\tif gotMD5Sum := md5Sum(data); !bytes.Equal(gotMD5Sum, external.Checksum.MD5) {\n\t\t\terr := fmt.Errorf(\"MD5 mismatch: expected %s, got %s\", external.Checksum.MD5, hex.EncodeToString(gotMD5Sum))\n\t\t\terrs = append(errs, err)\n\t\t}\n\t}\n\n\tif external.Checksum.RIPEMD160 != nil {\n\t\ts.warnFunc(\n\t\t\t\"%s: warning: insecure RIPEMD-160 checksum will be removed, use a secure hash like SHA256 instead\\n\",\n\t\t\texternalRelPath,\n\t\t)\n\t\tif gotRIPEMD160Sum := ripemd160Sum(data); !bytes.Equal(gotRIPEMD160Sum, external.Checksum.RIPEMD160) {\n\t\t\tformat := \"RIPEMD-160 mismatch: expected %s, got %s\"\n\t\t\terr := fmt.Errorf(format, external.Checksum.RIPEMD160, hex.EncodeToString(gotRIPEMD160Sum))\n\t\t\terrs = append(errs, err)\n\t\t}\n\t}\n\n\tif external.Checksum.SHA1 != nil {\n\t\ts.warnFunc(\n\t\t\t\"%s: warning: insecure SHA1 checksum will be removed, use a secure hash like SHA256 instead\\n\",\n\t\t\texternalRelPath,\n\t\t)\n\t\tif gotSHA1Sum := sha1Sum(data); !bytes.Equal(gotSHA1Sum, external.Checksum.SHA1) {\n\t\t\terr := fmt.Errorf(\"SHA1 mismatch: expected %s, got %s\", external.Checksum.SHA1, hex.EncodeToString(gotSHA1Sum))\n\t\t\terrs = append(errs, err)\n\t\t}\n\t}\n\n\tif external.Checksum.SHA256 != nil {\n\t\tif gotSHA256Sum := sha256.Sum256(data); !bytes.Equal(gotSHA256Sum[:], external.Checksum.SHA256) {\n\t\t\tformat := \"SHA256 mismatch: expected %s, got %s\"","sourceCodeStart":1694,"sourceCodeEnd":1730,"githubUrl":"https://github.com/twpayne/chezmoi/blob/f901167e4685db90da56d6a2a19df642cb3e0247/internal/chezmoi/sourcestate.go#L1694-L1730","documentation":"Same verification flow as other checksums: if external.Checksum.RIPEMD160 is set in the external entry and ripemd160Sum(data) does not match the downloaded data, chezmoi emits this mismatch error. RIPEMD-160 is flagged as insecure and slated for removal, so a SHA256 checksum is recommended.","triggerScenarios":"Fetching an external whose checksum.ripemd160 field was declared; the computed RIPEMD-160 digest of the downloaded bytes differs from the declared value.","commonSituations":"Legacy external configs copied from old dotfile repos; upstream file updated after the checksum was pinned; typo'd or hex/base64 confusion when transcribing the digest.","solutions":["Recompute with a RIPEMD-160 tool (e.g. openssl rmd160 file) and update checksum.ripemd160.","Migrate the checksum to checksum.sha256, since RIPEMD-160 support will be removed.","Verify the URL still points at the exact release/artifact you pinned.","Remove the checksum if you accept unverified downloads."],"exampleFix":"// before\nchecksum.ripemd160 = \"9c1185a5c5e9fc54612808977ee8f548\"\n// after\nchecksum.sha256 = \"<sha256 of the downloaded file>\"","handlingStrategy":"validation","validationCode":"openssl rmd160 <downloaded-file>\n# Compare with checksum.ripemd160 before applying; prefer sha256 instead.","typeGuard":null,"tryCatchPattern":"// Detect RIPEMD-160 mismatch in a wrapper and fail fast:\nout, err := exec.Command(\"chezmoi\", \"apply\").CombinedOutput()\nif err != nil && strings.Contains(string(out), \"RIPEMD-160 mismatch\") {\n    return errors.New(\"refresh checksum.ripemd160 in .chezmoiexternal\")\n}","preventionTips":["Migrate legacy ripemd160 pins to sha256 now.","Recompute digests from the exact bytes the URL serves.","Beware hex vs base64 confusion when transcribing digests."],"tags":["checksum","external","integrity","ripemd160"],"backgroundTag":"checksum-mismatch","analyzedSha":"f901167e4685db90da56d6a2a19df642cb3e0247","analyzedAt":"2026-09-01T18:16:41.508Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T01:17:15.007Z"}