{"record":{"id":"6581d33c7984b03c","repo":"ipfs/kubo","slug":"sha-512-mismatch-expected-s-got-x","errorCode":null,"errorMessage":"SHA-512 mismatch: expected %s, got %x","messagePattern":"SHA-512 mismatch: expected (.+?), got %x","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/commands/update_github.go","lineNumber":265,"sourceCode":"\t// Parse \"<hex>  <filename>\\n\" format (standard sha512sum output).\n\tfields := strings.Fields(string(checksumData))\n\tif len(fields) < 1 {\n\t\treturn fmt.Errorf(\"empty or malformed .sha512 file\")\n\t}\n\twantHex := fields[0]\n\n\treturn verifySHA512(data, wantHex)\n}\n\n// verifySHA512 checks that data matches the given hex-encoded SHA-512 hash.\nfunc verifySHA512(data []byte, wantHex string) error {\n\twant, err := hex.DecodeString(wantHex)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid hex in SHA-512 checksum: %w\", err)\n\t}\n\tgot := sha512.Sum512(data)\n\tif !bytes.Equal(got[:], want) {\n\t\treturn fmt.Errorf(\"SHA-512 mismatch: expected %s, got %x\", wantHex, got[:])\n\t}\n\treturn nil\n}\n\n// assetNameForPlatformTag returns the expected archive filename for a given\n// release tag and the current GOOS/GOARCH.\nfunc assetNameForPlatformTag(tag string) string {\n\text := \"tar.gz\"\n\tif runtime.GOOS == \"windows\" {\n\t\text = \"zip\"\n\t}\n\treturn fmt.Sprintf(\"kubo_%s_%s-%s.%s\", tag, runtime.GOOS, runtime.GOARCH, ext)\n}\n","sourceCodeStart":247,"sourceCodeEnd":279,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/commands/update_github.go#L247-L279","documentation":"verifySHA512 computes SHA-512 over the downloaded data and compares it to the expected hex digest. When the digests differ, it reports the expected checksum and the hex of the actual digest. This means the downloaded archive's content does not match the published checksum — the download is treated as corrupt or tampered and the update aborts.","triggerScenarios":"downloadAndVerifySHA512 fetched an archive whose bytes hash to a digest different from wantHex: partial/interrupted download, a CDN/proxy serving different or cached content, or the checksum corresponds to a different release artifact.","commonSituations":"Flaky network truncating a large archive mid-download; corporate proxy or mirror serving stale files; the checksum in the release index was updated (release replaced) but the old binary/URL was fetched; wrong checksum recorded for a platform-specific asset.","solutions":["Re-download the archive (clear any cache/proxy) and retry the update","Compare the reported 'got' digest with the digest published on the release page / dist server to see which side is wrong","Check for proxy/CDN interference (fetch via a different network or direct URL)","If the release itself was re-published, refresh the local checksum source before retrying"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// No caller-side validation can prevent it; optionally pre-hash locally:\nwant, _ := hex.DecodeString(wantHex)\ngot := sha512.Sum512(data)\nfmt.Printf(\"local digest %x vs expected %x\\n\", got[:], want)","typeGuard":null,"tryCatchPattern":"if err := downloadAndVerifySHA512(url, wantHex); err != nil {\n    var mErr interface{ Mismatch() bool }\n    if strings.Contains(err.Error(), \"SHA-512 mismatch\") {\n        // re-download once, then surface the digests to the user\n        return retryDownload(url, wantHex, 1)\n    }\n    return err\n}","preventionTips":["Always re-download from scratch on mismatch instead of trusting cached copies","Bypass proxies/CDNs when verifying artifacts","Keep checksums and artifacts versioned together"],"tags":["checksum","integrity","download"],"backgroundTag":"checksum-mismatch","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}