{"record":{"id":"7bfd2cf76b0427d9","repo":"BoundaryML/baml","slug":"sha256-checksum-verification-failed-expected-actual","errorCode":null,"errorMessage":"SHA256 checksum verification failed. Expected: {}, Actual: {}","messagePattern":"SHA256 checksum verification failed\\. Expected: (.+?), Actual: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"engine/playground-server/src/server.rs","lineNumber":284,"sourceCode":"    }\n\n    let checksum_text = checksum_resp.text().await?;\n\n    // Parse the expected checksum (format: \"hash filename\" or just \"hash\")\n    let expected_checksum = checksum_text\n        .split_whitespace()\n        .next()\n        .ok_or_else(|| anyhow::anyhow!(\"Invalid checksum file format\"))?\n        .to_lowercase();\n\n    // Calculate actual checksum\n    let mut hasher = Sha256::new();\n    hasher.update(file_bytes);\n    let actual_checksum = format!(\"{:x}\", hasher.finalize());\n\n    // Verify checksums match\n    if actual_checksum != expected_checksum {\n        return Err(anyhow::anyhow!(\n            \"SHA256 checksum verification failed. Expected: {}, Actual: {}\",\n            expected_checksum,\n            actual_checksum\n        ));\n    }\n\n    tracing::info!(\"SHA256 checksum verification passed\");\n    Ok(())\n}\n","sourceCodeStart":266,"sourceCodeEnd":294,"githubUrl":"https://github.com/BoundaryML/baml/blob/bd85ce9dee1463ff04d27efd20531013a4ff46c1/engine/playground-server/src/server.rs#L266-L294","documentation":"verify_sha256_checksum computes SHA-256 of the downloaded asset bytes and compares to the expected checksum from the checksum file. On mismatch it errors with both hashes, refusing to extract a potentially corrupt or tampered archive.","triggerScenarios":"actual_checksum != expected_checksum after hashing file_bytes — the downloaded archive bytes differ from what the published checksum describes.","commonSituations":"Interrupted/corrupted download (truncated archive); CDN serving a stale or different asset for the same URL; proxy injecting content (HTML error pages); asset re-uploaded without updating the checksum file; case mismatch handled via to_lowercase, so usually genuine byte differences.","solutions":["Re-download (delete the partial cache under ~/.baml/playground and retry) — transient corruption is most common.","Compare the logged Expected/Actual hashes with `sha256sum` of a manually downloaded asset to identify which side is stale.","If the release was re-uploaded, regenerate and republish the checksum file; otherwise check for a transparent proxy altering the payload."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"sha256sum downloaded-asset.tar.gz | awk '{print $1}'  # compare with published value before install","typeGuard":null,"tryCatchPattern":"match get_playground_dist().await {\n    Err(e) if e.to_string().contains(\"SHA256 checksum verification failed\") => {\n        purge_cache(\"~/.baml/playground\");\n        retry_once_or_alert();\n    }\n    r => r?,\n}","preventionTips":["Delete partial/corrupt downloads before retrying.","Keep checksum files in sync whenever assets are re-uploaded.","Investigate any proxy that could mutate response bodies."],"tags":["security","checksum","integrity","rust"],"backgroundTag":"checksum-mismatch","analyzedSha":"bd85ce9dee1463ff04d27efd20531013a4ff46c1","analyzedAt":"2026-09-12T03:38:25.718Z","contentChangedAt":"2026-09-12T03:38:25.718Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}