{"record":{"id":"7ac816cc795b0835","repo":"apache/beam","slug":"bad-sha256-for-v-v-want-v","errorCode":null,"errorMessage":"bad SHA256 for %v: %v, want %v","messagePattern":"bad SHA256 for (.+?): (.+?), want (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sdks/go/pkg/beam/artifact/materialize.go","lineNumber":261,"sourceCode":"\t\tfd.Close() // drop any buffered content\n\t\treturn errors.Wrapf(err, \"failed to retrieve chunk for %v\", filename)\n\t}\n\tif err := w.Flush(); err != nil {\n\t\tfd.Close()\n\t\treturn errors.Wrapf(err, \"failed to flush chunks for %v\", filename)\n\t}\n\tstat, _ := fd.Stat()\n\tlog.Printf(\"Downloaded: %v (sha256: %v, size: %v)\", filename, sha256Hash, stat.Size())\n\n\tif err := fd.Close(); err != nil {\n\t\treturn err\n\t}\n\n\tif isArtifactValidationEnabled(ctx) {\n\t\tif a.expectedSha256 == \"\" {\n\t\t\tlog.Printf(\"WARN: Artifact validation skipped for file: %v\", filename)\n\t\t} else if sha256Hash != a.expectedSha256 {\n\t\t\treturn errors.Errorf(\"bad SHA256 for %v: %v, want %v\", filename, sha256Hash, a.expectedSha256)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc writeChunks(stream jobpb.ArtifactRetrievalService_GetArtifactClient, w io.Writer) (string, error) {\n\tsha256W := sha256.New()\n\tfor {\n\t\tchunk, err := stream.Recv()\n\t\tif err == io.EOF {\n\t\t\tbreak\n\t\t}\n\t\tif err != nil {\n\t\t\treturn \"\", err\n\t\t}\n\t\tif _, err := sha256W.Write(chunk.Data); err != nil {\n\t\t\tpanic(err) // cannot fail","sourceCodeStart":243,"sourceCodeEnd":279,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/go/pkg/beam/artifact/materialize.go#L243-L279","documentation":"Returned by artifact.retrieve when the SHA256 of the downloaded artifact does not match the expected hash recorded in the artifact's type payload. Validation runs only when artifact validation is enabled (default true via WithArtifactValidation/context). It means the artifact was corrupted or replaced in transit or at rest.","triggerScenarios":"Materialize downloading an artifact whose computed sha256 differs from expectedSha256 (from ArtifactFilePayload/ArtifactUrlPayload). Triggered by corrupted staging content, a re-staged artifact of the same name with different bytes, or a truncated/modified transfer that still completed.","commonSituations":"Artifacts re-staged between submission and retrieval while hashes went stale; flaky proxy/cache mangling content; manually edited staged files; known issue where a proxy or registry injects content. Disabling via WithArtifactValidation(ctx, false) skips the check (with a WARN when no hash is present).","solutions":["Re-stage/re-submit the pipeline so artifact metadata hashes match the freshly staged content.","Rerun retrieval — MultiRetrieve retries, but a deterministic hash mismatch needs re-staging, not retrying.","Check for content-altering middleboxes (proxies, virus scanners) between worker and staging service.","As a last resort for known-benign mismatches, call artifact.WithArtifactValidation(ctx, false) to disable checks."],"exampleFix":"// before: stale staged artifact reused after content changed\n// re-stage and resubmit:\n//   beam job submission --artifacts_dir fresh_dir\n// or temporarily disable validation for debugging:\n// after\nctx = artifact.WithArtifactValidation(ctx, false)","handlingStrategy":"fallback","validationCode":"func verifyArtifactHash(path, expected string) error {\n\tif expected == \"\" { return nil }\n\t// compute sha256 of staged content and compare before relying on retrieval\n\tf, err := os.Open(path)\n\tif err != nil { return err }\n\tdefer f.Close()\n\th := sha256.New()\n\tif _, err := io.Copy(h, f); err != nil { return err }\n\tgot := hex.EncodeToString(h.Sum(nil))\n\tif got != expected { return fmt.Errorf(\"sha256 mismatch: got %s want %s\", got, expected) }\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if err := artifact.Materialize(ctx, endpoint, deps, rt, dest); err != nil {\n\tif strings.Contains(err.Error(), \"bad SHA256\") {\n\t\tlog.Printf(\"artifact corrupted in transit/staging; re-staging and retrying once\")\n\t\t// re-stage artifacts, then retry Materialize once\n\t}\n\treturn err\n}","preventionTips":["Never mutate staged artifact files after hashing at submission time.","Re-submit the job if artifacts changed — hashes in metadata go stale.","Keep proxies/caches out of the artifact transfer path or configure them content-safe.","Only disable validation (WithArtifactValidation(ctx, false)) in trusted debugging scenarios."],"tags":["go","integrity","checksum","beam-artifacts"],"backgroundTag":"checksum-mismatch","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}