{"record":{"id":"48f6d771e267fc7a","repo":"twpayne/chezmoi","slug":"sha256-mismatch-expected-s-got-s","errorCode":null,"errorMessage":"SHA256 mismatch: expected %s, got %s","messagePattern":"SHA256 mismatch: expected (.+?), got (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/chezmoi/sourcestate.go","lineNumber":1731,"sourceCode":"\t\t\terrs = append(errs, err)\n\t\t}\n\t}\n\n\tif external.Checksum.SHA1 != nil {\n\t\ts.warnFunc(\n\t\t\t\"%s: warning: insecure SHA1 checksum will be removed, use a secure hash like SHA256 instead\\n\",\n\t\t\texternalRelPath,\n\t\t)\n\t\tif gotSHA1Sum := sha1Sum(data); !bytes.Equal(gotSHA1Sum, external.Checksum.SHA1) {\n\t\t\terr := fmt.Errorf(\"SHA1 mismatch: expected %s, got %s\", external.Checksum.SHA1, hex.EncodeToString(gotSHA1Sum))\n\t\t\terrs = append(errs, err)\n\t\t}\n\t}\n\n\tif external.Checksum.SHA256 != nil {\n\t\tif gotSHA256Sum := sha256.Sum256(data); !bytes.Equal(gotSHA256Sum[:], external.Checksum.SHA256) {\n\t\t\tformat := \"SHA256 mismatch: expected %s, got %s\"\n\t\t\terr := fmt.Errorf(format, external.Checksum.SHA256, hex.EncodeToString(gotSHA256Sum[:]))\n\t\t\terrs = append(errs, err)\n\t\t}\n\t}\n\n\tif external.Checksum.SHA384 != nil {\n\t\tif gotSHA384Sum := sha384Sum(data); !bytes.Equal(gotSHA384Sum, external.Checksum.SHA384) {\n\t\t\terrs = append(errs, fmt.Errorf(\"SHA384 mismatch: expected %s, got %s\",\n\t\t\t\texternal.Checksum.SHA384, hex.EncodeToString(gotSHA384Sum)))\n\t\t}\n\t}\n\n\tif external.Checksum.SHA512 != nil {\n\t\tif gotSHA512Sum := sha512Sum(data); !bytes.Equal(gotSHA512Sum, external.Checksum.SHA512) {\n\t\t\terrs = append(errs, fmt.Errorf(\"SHA512 mismatch: expected %s, got %s\",\n\t\t\t\texternal.Checksum.SHA512, hex.EncodeToString(gotSHA512Sum)))\n\t\t}\n\t}\n","sourceCodeStart":1713,"sourceCodeEnd":1749,"githubUrl":"https://github.com/twpayne/chezmoi/blob/f901167e4685db90da56d6a2a19df642cb3e0247/internal/chezmoi/sourcestate.go#L1713-L1749","documentation":"The SHA256 branch of chezmoi's external checksum verification. If external.Checksum.SHA256 is declared and sha256.Sum256(data) does not match, this error is created and accumulated. SHA256 is the secure, recommended checksum, so no deprecation warning accompanies it.","triggerScenarios":"An external entry with checksum.sha256 is fetched and the digest of the downloaded bytes differs from the declared value.","commonSituations":"Upstream re-released the artifact (checksum pinned in config no longer valid); checksum copied with whitespace/shortened; hashing the wrong file; CDN serving a redirect/error page instead of the artifact.","solutions":["Recompute with curl -sL <url> | sha256sum and update checksum.sha256 in .chezmoiexternal.","Confirm the URL returns the artifact (not an HTML error page) — inspect what you actually downloaded.","If upstream is trustworthy but volatile, refresh the checksum on each release update.","Remove the checksum field to skip verification (not recommended)."],"exampleFix":"// before\nchecksum.sha256 = \"e3b0c44298fc1c14...\"\n// after (recompute for the new release)\nchecksum.sha256 = \"<new sha256sum>\"","handlingStrategy":"validation","validationCode":"# Pre-validate the artifact digest before applying:\nexpected=$(tomlq -r '.starship.\"checksum.sha256\"' .chezmoiexternal.toml)\nactual=$(curl -sL \"$URL\" | sha256sum | cut -d' ' -f1)\n[ \"$expected\" = \"$actual\" ] || echo \"checksum drift detected\"","typeGuard":null,"tryCatchPattern":"out, err := exec.Command(\"chezmoi\", \"apply\").CombinedOutput()\nif err != nil && strings.Contains(string(out), \"SHA256 mismatch\") {\n    return fmt.Errorf(\"refresh sha256 in .chezmoiexternal: %s\", out)\n}","preventionTips":["Compute sha256 in CI from the exact release asset and commit it with the config change.","Watch upstream releases (Dependabot/renovate style) and update digest + URL together.","Use immutable permalinks (tagged releases) so digests stay valid.","Dry-run apply before real apply to surface drift safely."],"tags":["checksum","external","integrity","sha256"],"backgroundTag":"checksum-mismatch","analyzedSha":"f901167e4685db90da56d6a2a19df642cb3e0247","analyzedAt":"2026-09-01T18:16:41.508Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T01:17:15.007Z"}