{"record":{"id":"7704ccbda68a1371","repo":"langchain-ai/deepagents","slug":"checksum-mismatch-for-path-name-expected-expec","errorCode":null,"errorMessage":"Checksum mismatch for {path.name}: expected {expected_hex}, got {actual}","messagePattern":"Checksum mismatch for (.+?): expected (.+?), got (.+?)","errorType":"exception","errorClass":"ChecksumMismatchError","httpStatus":null,"severity":"error","filePath":"libs/code/deepagents_code/managed_tools.py","lineNumber":599,"sourceCode":"    with path.open(\"rb\") as fh:\n        for chunk in iter(lambda: fh.read(1 << 20), b\"\"):\n            digest.update(chunk)\n    return digest.hexdigest()\n\n\ndef _verify_sha256(path: Path, expected_hex: str) -> None:\n    \"\"\"Verify `path` matches `expected_hex`.\n\n    Raises:\n        ChecksumMismatchError: When the SHA-256 of `path` differs from\n            `expected_hex`.\n    \"\"\"\n    actual = _sha256(path)\n    if actual != expected_hex:\n        msg = (\n            f\"Checksum mismatch for {path.name}: expected {expected_hex}, got {actual}\"\n        )\n        raise ChecksumMismatchError(msg)\n\n\ndef _extract_rg(archive: Path, extract_root: Path) -> Path:\n    \"\"\"Extract `archive` and locate the `rg` binary inside.\n\n    Handles both `.tar.gz` and `.zip` archives. Release archives nest the\n    binary under `ripgrep-<ver>-<triple>/`, so we walk the tree to find it\n    rather than hard-coding the prefix. Malformed archives or unsafe\n    members propagate `tarfile.TarError` / `zipfile.BadZipFile`.\n\n    Returns:\n        Absolute path to the extracted `rg` (or `rg.exe`) binary.\n\n    Raises:\n        FileNotFoundError: When the archive does not contain an `rg` binary.\n    \"\"\"\n    import tarfile\n    import zipfile","sourceCodeStart":581,"sourceCodeEnd":617,"githubUrl":"https://github.com/langchain-ai/deepagents/blob/a1af029e6e73cb17c36bff823d227747b28e91e1/libs/code/deepagents_code/managed_tools.py#L581-L617","documentation":"`_verify_sha256` raises `ChecksumMismatchError` when the SHA-256 of the downloaded archive does not match the pinned expected hash. This is an integrity guard against truncated, corrupted, or tampered downloads of managed tools.","triggerScenarios":"`_install_ripgrep_sync` completing a download whose bytes differ from the pinned hash — a truncated download (disk full, connection cut at the end), a proxy injecting content (captive portals, SSL-intercepting middleboxes), or a version mismatch where the code pins a hash for a release that the mirror replaced.","commonSituations":"Corporate SSL-inspection proxies substituting certificates/content; partial downloads after a network blip; pinned hash lagging a re-tagged upstream release; malicious mirror.","solutions":["Delete the cached/corrupt archive and re-download (`rm <archive>` then rerun the install)","Bypass or reconfigure SSL-intercepting proxies so the original bytes arrive","If the upstream release legitimately changed, update the pinned `expected_hex` in the manifest/code to the officially published SHA-256"],"exampleFix":"// before\nEXPECTED_SHA256[\"rg-14.1.0.tar.gz\"] = \"aaaaaaaa...\"  # stale pin\n// after\n$ sha256sum rg-14.1.0.tar.gz\nbbbbbbbb...  rg-14.1.0.tar.gz\n# update pin to the value published in the upstream release notes\nEXPECTED_SHA256[\"rg-14.1.0.tar.gz\"] = \"bbbbbbbb...\"","handlingStrategy":"retry","validationCode":"import hashlib\nfrom pathlib import Path\n\ndef matches_pin(archive: Path, expected_hex: str) -> bool:\n    h = hashlib.sha256(archive.read_bytes()).hexdigest()\n    return h == expected_hex\n\nif not matches_pin(archive, EXPECTED):\n    archive.unlink()  # discard corrupt download before retrying","typeGuard":null,"tryCatchPattern":"try:\n    _install_ripgrep_sync()\nexcept ChecksumMismatchError as exc:\n    logger.error(\"integrity failure: %s\", exc)\n    raise SystemExit(\n        \"download corrupted or tampered; remove cache, disable SSL proxy, retry\"\n    )","preventionTips":["Never bypass checksum verification; always re-download on mismatch","Check whether a corporate SSL-inspecting proxy rewrites downloads","Update pinned hashes only from the upstream project's official release notes"],"tags":["security","checksum","download"],"backgroundTag":"checksum-mismatch","analyzedSha":"a1af029e6e73cb17c36bff823d227747b28e91e1","analyzedAt":"2026-08-29T11:43:24.718Z","schemaVersion":2},"datasetVersion":"2026-08-29T12:17:43.993Z"}