{"record":{"id":"4fb50372cd0a145d","repo":"nikivdev/code","slug":"checksum-mismatch-for-expected-got","errorCode":null,"errorMessage":"checksum mismatch for {} (expected {}, got {})","messagePattern":"checksum mismatch for (.+?) \\(expected (.+?), got (.+?)\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/upgrade.rs","lineNumber":665,"sourceCode":"        println!(\"[dry-run] Would install to: {}\", output_path.display());\n        return Ok(());\n    }\n\n    // Download the release\n    let temp_tarball = env::temp_dir().join(\"flow_upgrade.tar.gz\");\n    download_with_progress(&client, &tarball_asset.browser_download_url, &temp_tarball)?;\n\n    let insecure = env_truthy(\"FLOW_UPGRADE_INSECURE\");\n    if let Some(asset) = checksums_asset {\n        let temp_checksums = env::temp_dir().join(\"flow_upgrade_checksums.txt\");\n        download_with_progress(&client, &asset.browser_download_url, &temp_checksums)?;\n        let checksums = fs::read_to_string(&temp_checksums)\n            .context(\"failed to read downloaded checksums.txt\")?;\n\n        if let Some(expected) = parse_sha256_from_checksums(&checksums, &tarball_asset.name) {\n            let actual = sha256_file(&temp_tarball)?;\n            if expected.to_lowercase() != actual.to_lowercase() {\n                bail!(\n                    \"checksum mismatch for {} (expected {}, got {})\",\n                    tarball_asset.name,\n                    expected,\n                    actual\n                );\n            }\n            println!(\"Checksum verified.\");\n        } else if insecure {\n            eprintln!(\n                \"Warning: checksums.txt does not contain {}; skipping checksum verification (FLOW_UPGRADE_INSECURE=1).\",\n                tarball_asset.name\n            );\n        } else {\n            bail!(\n                \"checksums.txt does not contain {}. Refusing to install.\\n\\\n                 Set FLOW_UPGRADE_INSECURE=1 to bypass (not recommended).\",\n                tarball_asset.name\n            );","sourceCodeStart":647,"sourceCodeEnd":683,"githubUrl":"https://github.com/nikivdev/code/blob/a747e741ae92c09071d0ae946ab48488adcff1ce/src/upgrade.rs#L647-L683","documentation":"In the upgrade `run` flow (src/upgrade.rs:~660), the downloaded checksums.txt is parsed for the tarball's expected SHA-256 and compared against `sha256_file(&temp_tarball)`. On any difference the upgrade refuses to install. This is an integrity guard against corrupted or tampered downloads.","triggerScenarios":"`parse_sha256_from_checksums` found an entry for the asset, but `expected.to_lowercase() != actual.to_lowercase()` — the computed hash of the downloaded tarball differs from the published one.","commonSituations":"Truncated download over flaky network/proxy; a caching proxy or mirror serving a stale/modified artifact; MITM tampering; the asset was re-uploaded (release re-cut) after checksums.txt was generated.","solutions":["Delete the cached tarball and retry the upgrade to rule out a corrupted download.","Verify manually: `sha256sum <tarball>` and compare to the release's checksums.txt.","Disable or bypass any HTTP proxy/mirror cache and retry.","Check the GitHub release — if it was re-published, wait for consistent assets or report to maintainers.","Investigate network security (corporate TLS interception) if mismatch persists."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# verify integrity yourself before trusting the download\nEXPECTED=$(awk -v f=\"$ASSET_NAME\" '$2==f{print $1}' checksums.txt)\nACTUAL=$(sha256sum \"$TARBALL\" | cut -d' ' -f1)\n[ \"${EXPECTED,,}\" = \"${ACTUAL,,}\" ] || { echo \"checksum mismatch — do not install\"; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always verify sha256 against checksums.txt before installing any release artifact.","Re-download once before suspecting tampering — most mismatches are truncated downloads.","Avoid untrusted mirrors/proxies that can serve stale artifacts.","Treat persistent mismatches as a supply-chain incident; report to maintainers."],"tags":["checksum","sha256","integrity","supply-chain"],"backgroundTag":"checksum-mismatch","analyzedSha":"a747e741ae92c09071d0ae946ab48488adcff1ce","analyzedAt":"2026-09-01T22:43:55.719Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}