{"record":{"id":"5bbf7d05ff051baa","repo":"jdx/mise","slug":"verified-checksum-file-digest-does-not-match-exist","errorCode":null,"errorMessage":"verified checksum file digest does not match existing checksum for {filename}","messagePattern":"verified checksum file digest does not match existing checksum for (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/backend/aqua.rs","lineNumber":2744,"sourceCode":"                && !cosign_already_verified\n                && checksum_path.exists()\n            {\n                self.cosign_checksums(ctx, cosign, pkg, v, tv, &checksum_path)\n                    .await?;\n            }\n\n            if needs_verified_checksum_binding && checksum_path.exists() {\n                let checksum_content = file::read_to_string_bom(&checksum_path)?;\n                let checksum_str =\n                    self.parse_checksum_from_content(&checksum_content, checksum, filename)?;\n                let checksum_val = format!(\"{}:{}\", checksum.algorithm(), checksum_str);\n                let platform_key = self.get_platform_key();\n                let platform_info = tv.lock_platforms.entry(platform_key).or_default();\n                if let Some(existing_checksum) = &platform_info.checksum\n                    && same_checksum_algorithm(existing_checksum, &checksum_val)\n                    && existing_checksum != &checksum_val\n                {\n                    bail!(\n                        \"verified checksum file digest does not match existing checksum for {filename}\"\n                    );\n                }\n                platform_info.checksum = Some(checksum_val);\n            }\n        }\n        if let Some(pi) = tv.lock_platforms.get_mut(&platform_key)\n            && pi.provenance.is_some()\n        {\n            pi.github_attestations = None;\n        }\n\n        // If lockfile recorded verified provenance, verify that the type matches\n        // (checked after all verification methods including cosign have had a chance to record)\n        if let Some(expected) = expected_provenance {\n            let platform_key = self.get_platform_key();\n            let got = tv\n                .lock_platforms","sourceCodeStart":2726,"sourceCodeEnd":2762,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/backend/aqua.rs#L2726-L2762","documentation":"After mise verifies a download against an aqua checksum file, it records the verified digest in the tool version's lock platform entry. If a checksum already exists in the lockfile for this platform, uses the same algorithm, and differs from the newly verified digest, mise refuses to proceed — the same file now hashes differently, which usually means tampering, a corrupted mirror, or a silently changed upstream release.","triggerScenarios":"Installing or re-verifying an aqua-managed tool (src/backend/aqua.rs:2744) when mise.lock / the lock platform already stores a checksum for the same platform+filename, same algorithm, but the freshly computed digest differs.","commonSituations":"Upstream force-pushed or re-uploaded a release asset without changing the version tag; a mirror serves a modified artifact; lockfile was generated on a setup where a different (corrupt) artifact was cached; malicious supply-chain attempt.","solutions":["Treat this as a possible supply-chain issue: verify the upstream release's official checksums before proceeding","Delete the stale lockfile entry (edit mise.lock or remove the platform checksum) only after confirming the new digest is legitimate","Clear the download cache for the tool and re-download from the canonical source","Pin to a different version whose assets were not re-uploaded; report the re-uploaded asset to the upstream project"],"exampleFix":"# after confirming upstream intentionally re-published the asset:\nmise use -g aqua:owner/repo@1.2.3 --force   # or remove the stale checksum block in mise.lock first","handlingStrategy":"try-catch","validationCode":"// before upgrading, compare lockfile checksum vs upstream release notes' published digests\nconst lock = JSON.parse(fs.readFileSync(\"mise.lock\", \"utf8\"));\nconst stored = lock?.[\"aqua:owner/repo\"]?.platforms?.[\"linux-amd64\"]?.checksum;\nif (stored) console.log(\"existing locked checksum:\", stored, \"— verify against upstream before reinstalling\");","typeGuard":null,"tryCatchPattern":"try {\n  await $`mise install`;\n} catch (e) {\n  if (String(e).includes(\"does not match existing checksum\")) {\n    // DO NOT blindly fix: audit the upstream release for tampering/re-uploads first,\n    // then remove the stale checksum entry and reinstall.\n    await $`mise use aqua:owner/repo@${version} --force`;\n  } else throw e;\n}","preventionTips":["Treat any checksum-change error as a security signal; verify upstream digests before overriding","Never override by editing the lockfile until the new digest is confirmed against the project's official checksums","Watch upstream releases for force-pushed assets; subscribe to release notifications for pinned tools","Use canonical download sources, not third-party mirrors"],"tags":["aqua","checksum","integrity","lockfile"],"backgroundTag":"checksum-mismatch","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}