{"record":{"id":"690134578ede33ea","repo":"k3s-io/k3s","slug":"failed-to-verify-directory-s","errorCode":null,"errorMessage":"failed to verify directory %s","messagePattern":"failed to verify directory (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/dataverify/dataverify.go","lineNumber":28,"sourceCode":"\t\"path/filepath\"\n\t\"strings\"\n\n\t\"github.com/sirupsen/logrus\"\n)\n\n// Verify will check the sha256sums and links from the files in a given directory\nfunc Verify(dir string) error {\n\tfailed := false\n\tif err := VerifySums(dir, \".sha256sums\"); err != nil {\n\t\tlogrus.Errorf(\"Unable to verify sums: %s\", err)\n\t\tfailed = true\n\t}\n\tif err := VerifyLinks(dir, \".links\"); err != nil {\n\t\tlogrus.Errorf(\"Unable to verify links: %s\", err)\n\t\tfailed = true\n\t}\n\tif failed {\n\t\treturn fmt.Errorf(\"failed to verify directory %s\", dir)\n\t}\n\treturn nil\n}\n\n// VerifySums will take a file which contains a list of hash sums for files and verify they match\nfunc VerifySums(root, sumListFile string) error {\n\tsums, err := fileMapFields(filepath.Join(root, sumListFile), 1, 0)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif len(sums) == 0 {\n\t\treturn fmt.Errorf(\"no entries found in %s\", sumListFile)\n\t}\n\tnumFailed := 0\n\tfor sumFile, sumExpected := range sums {\n\t\tfile := filepath.Join(root, sumFile)\n\t\tsumActual, _ := sha256Sum(file)\n\t\tif sumExpected != sumActual {","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/dataverify/dataverify.go#L10-L46","documentation":"dataverify.Verify runs checksum (VerifySums over .sha256sums) and symlink (VerifyLinks over .links) validation over a directory. It is called from cmd/k3s/main.go:306 on the freshly untarred embedded data bundle (<data-dir>/data/<version>-tmp/bin) before a new k3s data dir is activated - it is the integrity gate for the packed agent/controller binaries. This aggregate error fires when either check failed; the specific failure is logged just above via 'Unable to verify sums/links'.","triggerScenarios":"Any hash mismatch, symlink mismatch, or unparseable/empty .sha256sums/.links file inside the extracted bin directory during data-dir preparation on startup or upgrade (cmd/k3s/main.go:303-308).","commonSituations":"Truncated or corrupted binary download/install; bit rot or a failing disk corrupting extracted files; antivirus quarantine emptying files; a tampered or hand-modified build; untar interrupted by disk-full.","solutions":["Read the log lines immediately above the error ('Unable to verify sums: ...' / 'Unable to verify links: ...') to see which sub-check failed.","Reinstall k3s from an official release (verify the binary/archives checksum yourself), then delete the leftover <data-dir>/data/*-tmp directory so extraction reruns cleanly.","Check filesystem health: dmesg for I/O errors, smartctl, and df for a full disk; fix the underlying storage issue before retrying."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Run the same verification k3s runs, after staging the binary / before restart:\nimport \"github.com/k3s-io/k3s/pkg/dataverify\"\n\nif err := dataverify.Verify(filepath.Join(dataDir, \"data\", version, \"bin\")); err != nil {\n    log.Fatalf(\"data dir integrity check failed: %v - refuse to start on damaged data\", err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify downloaded k3s binaries against the published sha256sum before installing.","Keep data-dir on a healthy POSIX filesystem with monitoring for disk errors and capacity.","Exclude the k3s data dir from antivirus scanning; alert on any 'failed to verify directory' in node logs."],"tags":["integrity","sha256","deployment","startup","airgap"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}