{"record":{"id":"58f6d259b8568c10","repo":"iOfficeAI/OfficeCLI","slug":"checksum-mismatch-for-asset-expected-expecte","errorCode":null,"errorMessage":"Checksum mismatch for ${asset} (expected ${expected}, got ${actual})","messagePattern":"Checksum mismatch for (.+?) \\(expected (.+?), got (.+?)\\)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"npm/lib/install-binary.js","lineNumber":207,"sourceCode":"  }\n  // SHA256SUMS rows are \"<hex>  <name>\" (sha256sum text mode). Match the\n  // filename column EXACTLY (a leading '*' marks binary mode), never a\n  // substring — same rule as install.sh / the C# self-updater.\n  let expected = null;\n  for (const line of sums.split('\\n')) {\n    const parts = line.trim().split(/\\s+/);\n    if (parts.length >= 2) {\n      const name = parts[1].replace(/^\\*/, '');\n      if (name === asset) { expected = parts[0]; break; }\n    }\n  }\n  if (!expected) {\n    log('  ' + asset + ' not listed in SHA256SUMS, skipping verification.');\n    return;\n  }\n  const actual = crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');\n  if (actual.toLowerCase() !== expected.toLowerCase()) {\n    throw new Error('Checksum mismatch for ' + asset + ' (expected ' + expected + ', got ' + actual + ')');\n  }\n  log('  checksum verified.');\n}\n\n// Download the platform binary into bin/ if it is not already present.\n// Idempotent: a non-empty binary is treated as already installed (the package\n// version pins the release, so existence is sufficient).\nasync function ensureBinary() {\n  const dest = binaryPath();\n  if (fs.existsSync(dest) && fs.statSync(dest).size > 0) {\n    return dest;\n  }\n  fs.mkdirSync(BIN_DIR, { recursive: true });\n  const asset = detectAsset();\n  let lastErr = null;\n  for (const url of assetUrls(asset)) {\n    try {\n      log('Downloading ' + asset + ' (' + TAG + ') from ' + url + ' ...');","sourceCodeStart":189,"sourceCodeEnd":225,"githubUrl":"https://github.com/iOfficeAI/OfficeCLI/blob/1ced45e900782c5083ed550ddf328ee974e425e7/npm/lib/install-binary.js#L189-L225","documentation":"Thrown by verifyChecksum() when the SHA-256 of the downloaded platform binary does not equal the value listed in SHA256SUMS for that asset. The installer pins a release tag and verifies integrity; a mismatch means the bytes on disk differ from the signed checksum list, so it refuses to install the corrupted/wrong file.","triggerScenarios":"A truncated or corrupted download (network drop, proxy rewriting bytes); the mirror serving a stale/erroneous asset under the right name; disk write interrupted mid-stream; a CDN edge caching a bad object; the wrong TAG/VERSION string yielding an asset whose SHA256SUMS row doesn't match.","commonSituations":"Flaky corporate proxy or transparent TLS inspector corrupting the stream; npm cache serving a partial file; the binary deleted/recreated between the download and the readFileSync; CI behind a caching layer with a poisoned blob.","solutions":["Delete the partial binary (rm -rf node_modules/@officecli/officecli/vendor) and the npm cache for the package, then reinstall.","Clear npm/global caches: `npm cache clean --force` and re-run install so the mirror is re-fetched.","Inspect the failing URL with `curl -fsSL <assetUrl> | sha256sum` to confirm whether the mirror or GitHub releases serves the bad bytes, then use whichever matches SHA256SUMS.","If a proxy/TLS inspector is involved, bypass it for d.officecli.ai and github.com, or download manually from GitHub releases and verify the checksum yourself before placing the binary."],"exampleFix":"// before: postinstall aborts with Checksum mismatch\n// after: purge the poisoned binary and re-fetch\nrm -rf node_modules/@officecli/officecli/vendor\nnpm cache clean --force\nnpm install","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Re-run install in a fresh cache; a checksum mismatch is usually a bad cached blob\ntry {\n  require('@officecli/officecli'); // triggers postinstall ensureBinary\n} catch (e) {\n  if (/Checksum mismatch/.test(e.message)) {\n    require('fs').rmSync(require('path').join(__dirname, 'node_modules/@officecli/officecli/vendor'), { recursive:true, force:true });\n    require('child_process').execSync('npm install', { stdio:'inherit' });\n  } else throw e;\n}","preventionTips":["Keep npm cache clean in CI (npm cache clean --force on suspected corruption).","Bypass byte-mutating proxies/TLS inspectors for the download hosts.","Pin the package version so TAG/SHA256SUMS stay stable."],"tags":["install","checksum","integrity","network","postinstall"],"backgroundTag":null,"analyzedSha":"1ced45e900782c5083ed550ddf328ee974e425e7","analyzedAt":"2026-08-13T13:01:07.193Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}