{"record":{"id":"6e1dff02f125efbf","repo":"cloudflare/cloudflared","slug":"checksum-validation-failed","errorCode":null,"errorMessage":"checksum validation failed","messagePattern":"checksum validation failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/updater/workers_update.go","lineNumber":99,"sourceCode":"// This includes signature and checksum validation,\n// replacing the binary, etc\nfunc (v *WorkersVersion) Apply() error {\n\tnewFilePath := fmt.Sprintf(\"%s.new\", v.targetPath)\n\tos.Remove(newFilePath) //remove any failed updates before download\n\n\t// download the file\n\tif err := download(v.downloadURL, newFilePath, v.isCompressed); err != nil {\n\t\treturn err\n\t}\n\n\tdownloadSum, err := cliutil.FileChecksum(newFilePath)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\t// Check that the file downloaded matches what is expected.\n\tif v.checksum != downloadSum {\n\t\treturn errors.New(\"checksum validation failed\")\n\t}\n\n\t// Check if the currently running version has the same checksum\n\tif downloadSum == buildInfo.Checksum {\n\t\t// Currently running binary matches the downloaded binary so we have no reason to update. This is\n\t\t// typically unexpected, as such we emit a sentry event.\n\t\tlocalHub := sentry.CurrentHub().Clone()\n\t\terr := errors.New(\"checksum validation matches currently running process\")\n\t\tlocalHub.CaptureException(err)\n\t\t// Make sure to cleanup the new downloaded file since we aren't upgrading versions.\n\t\tos.Remove(newFilePath)\n\t\treturn err\n\t}\n\n\toldFilePath := fmt.Sprintf(\"%s.old\", v.targetPath)\n\t// Windows requires more effort to self update, especially when it is running as a service:\n\t// you have to stop the service (if running as one) in order to move/rename the binary\n\t// but now the binary isn't running though, so an external process","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/updater/workers_update.go#L81-L117","documentation":"During self-update, Apply() downloads the new binary and compares its SHA checksum against the checksum advertised by the update service. This error means the downloaded file's checksum did not match v.checksum, so the update is aborted as possibly corrupt or tampered.","triggerScenarios":"Truncated or corrupted download; an intermediary (proxy, captive portal, antivirus) modifying the response body; stale CDN cache serving a binary that no longer matches the advertised checksum.","commonSituations":"Flaky corporate networks stripping content; MITM proxies re-signing TLS; updating from behind a caching proxy with an old artifact.","solutions":["Retry the update; transient truncation is the most common cause","Bypass proxies/VPNs and download directly, or manually download the release and verify its checksum yourself","Reinstall cloudflared from the official release instead of self-update","Check egress filtering/SSL inspection appliances that rewrite binary responses"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"// verify checksum manually when self-update fails\nsum := sha256.Sum256(data)\nif hex.EncodeToString(sum[:]) != advertisedChecksum {\n    return fmt.Errorf(\"download corrupted: got %s want %s\", hex.EncodeToString(sum[:]), advertisedChecksum)\n}","preventionTips":["Retry once before concluding corruption","Disable TLS-intercepting proxies/SSL inspection for cloudflared downloads","Prefer manual installs from official GitHub releases in locked-down networks","Check disk space — truncation can come from full disks"],"tags":["auto-update","checksum","integrity"],"backgroundTag":"checksum-mismatch","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}