{"record":{"id":"7e351f04e6be61c6","repo":"multica-ai/multica","slug":"checksum-mismatch-for-q-expected-s-got-s","errorCode":null,"errorMessage":"checksum mismatch for %q: expected %s, got %s","messagePattern":"checksum mismatch for %q: expected (.+?), got (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"server/internal/cli/update.go","lineNumber":222,"sourceCode":"\t\t}\n\t}\n\tif err := scanner.Err(); err != nil {\n\t\treturn \"\", fmt.Errorf(\"read checksum manifest: %w\", err)\n\t}\n\treturn \"\", fmt.Errorf(\"checksum for %q not found in manifest\", assetName)\n}\n\n// verifyAssetSHA256 returns nil when the SHA-256 of data matches the lowercase\n// hex expected value, or an error otherwise. The error includes both digests\n// so a corrupted asset is diagnosable from the log without re-downloading.\nfunc verifyAssetSHA256(data []byte, expectedHex, assetName string) error {\n\tif expectedHex == \"\" {\n\t\treturn fmt.Errorf(\"empty expected checksum for %q\", assetName)\n\t}\n\tsum := sha256.Sum256(data)\n\tactual := hex.EncodeToString(sum[:])\n\tif !strings.EqualFold(actual, expectedHex) {\n\t\treturn fmt.Errorf(\"checksum mismatch for %q: expected %s, got %s\", assetName, expectedHex, actual)\n\t}\n\treturn nil\n}\n\nfunc fetchReleaseByTag(tag string) (*GitHubRelease, error) {\n\tclient := &http.Client{Timeout: 10 * time.Second}\n\treq, err := http.NewRequest(http.MethodGet, \"https://api.github.com/repos/multica-ai/multica/releases/tags/\"+tag, nil)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treq.Header.Set(\"Accept\", \"application/vnd.github+json\")\n\n\tresp, err := client.Do(req)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tdefer resp.Body.Close()\n","sourceCodeStart":204,"sourceCodeEnd":240,"githubUrl":"https://github.com/multica-ai/multica/blob/2c0912b6ec764b373d44eeea1e80f0d9f11ab417/server/internal/cli/update.go#L204-L240","documentation":"The SHA-256 of the downloaded archive does not match the digest recorded in the release's checksums.txt. Both digests are included in the message so a corrupted asset is diagnosable without re-downloading. This is the supply-chain guard for the unattended auto-updater — a mismatch means the bytes you received are not the bytes that were published.","triggerScenarios":"A truncated or corrupted download (network proxy, flaky connection, mirror tampering), or a checksums.txt that belongs to a different version of the asset than the one downloaded.","commonSituations":"Corporate proxies that mangle binary downloads; CDN cache poisoning or a compromised mirror; downloading asset and manifest from two different release tags in a race; disk corruption mid-write.","solutions":["Re-run the update/download — transient corruption is the most common cause","Manually download the asset and checksums.txt and compare with sha256sum to confirm which side is wrong","If the mismatch persists on the official repo, report it: the release itself may be broken or compromised","Clear any caching proxy/mirror between you and github.com and retry","Do not skip or downgrade the verification — install the binary manually only after independently verifying its digest"],"exampleFix":"$ curl -LO https://github.com/multica-ai/multica/releases/download/v1.2.3/multica-cli-1.2.3-linux-amd64.tar.gz\n$ curl -LO https://github.com/multica-ai/multica/releases/download/v1.2.3/checksums.txt\n$ sha256sum -c checksums.txt --ignore-missing","handlingStrategy":"retry","validationCode":"sum := sha256.Sum256(data)\nactual := hex.EncodeToString(sum[:])\nif !strings.EqualFold(actual, expected) {\n\t// do not exec or install; retry the download once\n}","typeGuard":null,"tryCatchPattern":"err := cli.VerifyAssetSHA256(data, expected, name) // or equivalent\nif err != nil && strings.Contains(err.Error(), \"checksum mismatch\") {\n\tdata, dataErr := refetchAsset(url)\n\tif dataErr == nil {\n\t\terr = cli.VerifyAssetSHA256(data, expected, name)\n\t}\n\tif err != nil { /* quarantine: possible supply-chain compromise */ }\n}","preventionTips":["Retry once on mismatch, then stop — persistent mismatch signals corruption or tampering","Never disable checksum verification to make an update proceed","Independently verify digests (sha256sum -c) when manually installing","Bypass caching proxies for release downloads if mismatches recur"],"tags":["checksum","security","supply-chain","download","go"],"backgroundTag":null,"analyzedSha":"2c0912b6ec764b373d44eeea1e80f0d9f11ab417","analyzedAt":"2026-08-15T13:25:18.241Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}