{"record":{"id":"5bbf7d05ff051baa","repo":"jdx/mise","slug":"verified-checksum-file-digest-does-not-match-exist","errorCode":null,"errorMessage":"verified checksum file digest does not match existing checksum for {filename}","messagePattern":"verified checksum file digest does not match existing checksum for (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/backend/aqua.rs","lineNumber":2825,"sourceCode":"                && !cosign_already_verified\n                && checksum_path.exists()\n            {\n                self.cosign_checksums(ctx, cosign, pkg, v, tv, &checksum_path)\n                    .await?;\n            }\n\n            if needs_verified_checksum_binding && checksum_path.exists() {\n                let checksum_content = file::read_to_string_bom(&checksum_path)?;\n                let checksum_str =\n                    self.parse_checksum_from_content(&checksum_content, checksum, filename)?;\n                let checksum_val = format!(\"{}:{}\", checksum.algorithm(), checksum_str);\n                let platform_key = self.get_platform_key();\n                let platform_info = tv.lock_platforms.entry(platform_key).or_default();\n                if let Some(existing_checksum) = &platform_info.checksum\n                    && same_checksum_algorithm(existing_checksum, &checksum_val)\n                    && existing_checksum != &checksum_val\n                {\n                    bail!(\n                        \"verified checksum file digest does not match existing checksum for {filename}\"\n                    );\n                }\n                platform_info.checksum = Some(checksum_val);\n            }\n        }\n        if let Some(pi) = tv.lock_platforms.get_mut(&platform_key)\n            && pi.provenance.is_some()\n        {\n            pi.github_attestations = None;\n        }\n\n        // If lockfile recorded verified provenance, verify that the type matches\n        // (checked after all verification methods including cosign have had a chance to record)\n        if let Some(expected) = expected_provenance {\n            let platform_key = self.get_platform_key();\n            let got = tv\n                .lock_platforms","sourceCodeStart":2807,"sourceCodeEnd":2843,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/backend/aqua.rs#L2807-L2843","documentation":"After verifying a downloaded artifact against a checksum file, mise records the verified digest in the tool-version lock/platform info. This error is thrown when a digest was already recorded for the same file with the same checksum algorithm, but the newly computed digest differs — meaning the release content changed under the same version, or lockfile/platform state disagrees with what upstream now serves.","triggerScenarios":"Reinstalling or re-locking an aqua package when: the platform's checksum was previously recorded (e.g. in mise.lock or a prior install) and the re-downloaded artifact hashes to a different value with the same algorithm; upstream force-pushed/replaced release assets; a mirror served different content.","commonSituations":"Upstream re-tagged a version with different binaries; a proxy/mirror serves stale or tampered artifacts; switching networks (VPN, corporate proxy) changes what upstream returns; corruption between two installs of the same version.","solutions":["Treat this as a supply-chain red flag: verify on the upstream release page that the artifact was legitimately changed","If the release was legitimately re-tagged, remove the cached download and the stale checksum entry (delete the version from mise.lock / `mise uninstall <tool>@<ver>` then reinstall)","Check for a proxy or mirror serving different content and bypass it","File an issue with the aqua registry/upstream if the release was tampered with"],"exampleFix":"// before: stale recorded checksum for replaced release\nmise uninstall gh@2.40.0\nrm -rf ~/.local/share/mise/downloads/aqua/gh/2.40.0\n// after: fresh install re-verifies and records the new digest\nmise install gh@2.40.0","handlingStrategy":"validation","validationCode":"// before reinstalling, compare the served artifact digest with the recorded one\nconst digest = crypto.createHash('sha256').update(await fs.readFile(asset)).digest('hex');\nif (digest !== lockedChecksum) console.warn('Upstream artifact changed for same version — investigate before reinstalling');","typeGuard":null,"tryCatchPattern":"catch (e) {\n  if (String(e).includes('does not match existing checksum')) {\n    // stop and verify upstream legitimacy; do not auto-retry\n    console.error('Release content changed under the same version. Check the upstream release page before reinstalling.');\n  }\n}","preventionTips":["Commit mise.lock and review checksum-changing diffs in CI","Never auto-retry installs on checksum changes; treat as a supply-chain signal","Watch upstream releases for re-tags, which silently alter artifacts"],"tags":["aqua","checksum","supply-chain","lockfile"],"backgroundTag":"checksum-mismatch","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}