{"record":{"id":"832d864d67ab8bfe","repo":"github/copilot-sdk","slug":"checksum-mismatch-for-s-expected-s-got-s","errorCode":null,"errorMessage":"checksum mismatch for %s: expected %s, got %s","messagePattern":"checksum mismatch for (.+?): expected (.+?), got (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"go/cmd/bundler/main.go","lineNumber":1029,"sourceCode":"\n\t// Save tarball to temp file\n\ttarballPath := filepath.Join(destDir, assetName)\n\ttarballFile, err := os.Create(tarballPath)\n\tif err != nil {\n\t\treturn \"\", \"\", fmt.Errorf(\"failed to create tarball file: %w\", err)\n\t}\n\n\thasher := sha256.New()\n\tif _, err := io.Copy(io.MultiWriter(tarballFile, hasher), resp.Body); err != nil {\n\t\ttarballFile.Close()\n\t\treturn \"\", \"\", fmt.Errorf(\"failed to save tarball: %w\", err)\n\t}\n\tif err := tarballFile.Close(); err != nil {\n\t\treturn \"\", \"\", fmt.Errorf(\"failed to close tarball file: %w\", err)\n\t}\n\tactualChecksum := fmt.Sprintf(\"%x\", hasher.Sum(nil))\n\tif actualChecksum != expectedChecksum {\n\t\treturn \"\", \"\", fmt.Errorf(\n\t\t\t\"checksum mismatch for %s: expected %s, got %s\",\n\t\t\tassetName,\n\t\t\texpectedChecksum,\n\t\t\tactualChecksum,\n\t\t)\n\t}\n\n\t// The SDK release package intentionally omits the legacy SEA binary. Preserve\n\t// embeddedcli.Path compatibility by installing the runtime wrapper under the\n\t// historical copilot[.exe] name; the normal client path uses the adjacent\n\t// wrapper/runtime.node pair directly.\n\tbinaryPath := filepath.Join(destDir, binaryName)\n\twrapperName := runtimeWrapperName(binaryName)\n\tif err := extractFileFromTarball(\n\t\ttarballPath,\n\t\tdestDir,\n\t\t\"package/prebuilds/\"+runtimePlatform+\"/\"+wrapperName,\n\t\tbinaryName,","sourceCodeStart":1011,"sourceCodeEnd":1047,"githubUrl":"https://github.com/github/copilot-sdk/blob/cd8cf15dc3f9e762615790aaed0a771a0f392755/go/cmd/bundler/main.go#L1011-L1047","documentation":"The bundler verifies release-tarball integrity by comparing the SHA-256 computed during download against an expected checksum (from the release manifest/checksums file). On mismatch it refuses to use the downloaded asset and reports asset name, expected, and actual hashes. This guards against corrupted or tampered downloads (supply-chain protection).","triggerScenarios":"fmt.Sprintf(\"%x\", hasher.Sum(nil)) != expectedChecksum after a complete download — corrupted transfer, wrong checksum entry for the selected assetName, or a re-published release asset whose bytes changed.","commonSituations":"MITM or corrupted CDN cache serving different bytes; bundler version referencing a checksum from a different release; release maintainers re-uploading the asset; interrupted-but-truncated download that still closed cleanly.","solutions":["Delete the cached/failed tarball and re-download; transient corruption is the most common cause.","Confirm the expected checksum corresponds to the same release version and platform asset being downloaded.","If the release was re-published, update the bundler (or checksum list) to the new checksums.","Do not bypass the check; investigate the source of corruption instead."],"exampleFix":"// before: stale checksum pinned in release metadata\n\"expectedChecksum\": \"e3b0c44298fc1c14...\"\n\n// after: regenerate checksums for the republished release and update metadata\n\"expectedChecksum\": \"<sha256 of re-published tarball>\"","handlingStrategy":"validation","validationCode":"// verify the pinned checksum matches the release version you target\nwant, ok := releaseChecksums[releaseVersion][assetName]\nif !ok {\n    return fmt.Errorf(\"no checksum pinned for %s@%s\", assetName, releaseVersion)\n}","typeGuard":null,"tryCatchPattern":"if _, _, err := downloadCLIBinary(...); err != nil {\n    if strings.Contains(err.Error(), \"checksum mismatch\") {\n        purgeCache(); reDownloadWithFreshChecksums()\n    }\n    return err\n}","preventionTips":["Pin checksums per release version and platform asset; regenerate when releases are republished.","Never bypass or log-and-continue on checksum failure.","Delete corrupted cached tarballs instead of retrying against them.","Keep the bundler version in lockstep with the release channel it downloads from."],"tags":["checksum","sha256","integrity","supply-chain","go"],"backgroundTag":"checksum-mismatch","analyzedSha":"cd8cf15dc3f9e762615790aaed0a771a0f392755","analyzedAt":"2026-09-09T18:32:31.973Z","contentChangedAt":"2026-09-09T18:32:31.973Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}