{"record":{"id":"85fd4175927e470a","repo":"janhq/jan","slug":"checksum-mismatch-for-name-the-download-was-co","errorCode":null,"errorMessage":"Checksum mismatch for ${name}; the download was corrupt or tampered with","messagePattern":"Checksum mismatch for (.+?); the download was corrupt or tampered with","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"critical","filePath":"extensions/llamacpp-extension/src/backend.ts","lineNumber":195,"sourceCode":"    logger.warn(\n      `No usable checksums published for ${version}; skipping verification`\n    )\n    return\n  }\n\n  for (const savePath of savePaths) {\n    const name = savePath.split(/[\\\\/]/).pop() ?? ''\n    const expected = checksums[name]\n    if (!expected) {\n      logger.warn(`No checksum entry for ${name}; skipping verification`)\n      continue\n    }\n    if (await verifyFileSha512(savePath, expected)) {\n      logger.info(`Checksum verified for ${name}`)\n      continue\n    }\n    await fs.rm(savePath).catch(() => undefined)\n    throw new Error(\n      `Checksum mismatch for ${name}; the download was corrupt or tampered with`\n    )\n  }\n}\n\nexport async function downloadBackend(\n  backend: string,\n  version: string,\n  source: 'github' | 'cdn' = 'github'\n): Promise<void> {\n  const janDataFolderPath = await getJanDataFolderPath()\n  const sysInfo = await getSystemInfo()\n  const proxyConfig = await getProxyConfig()\n\n  const downloadItems: Array<{\n    url: string\n    save_path: string\n    model_id: string","sourceCodeStart":177,"sourceCodeEnd":213,"githubUrl":"https://github.com/janhq/jan/blob/fad3f12a147d138388a66f0d92a02b2675f65294/extensions/llamacpp-extension/src/backend.ts#L177-L213","documentation":"Thrown by verifyBackendChecksums after a SHA-512 integrity check fails for a downloaded backend binary. The downloaded file is deleted and the error propagates, halting the download flow. The check uses verifyFileSha512 against a checksums map keyed by filename, and only archives with a matching checksum entry are verified.","triggerScenarios":"A GitHub or CDN download completed but the file's SHA-512 digest does not match the expected value in the checksums map. Causes include network corruption, partial download, proxy/CDN serving a stale or wrong file, or a checksum map that is out of date relative to the published release.","commonSituations":"Flaky network or interrupted download leaving a truncated file; corporate proxy caching a different file; CDN replication lag after a new release; checksums map not yet updated for a new backend version.","solutions":["Retry the download — a transient corruption will produce a fresh file that passes verification.","Switch the source from 'github' to 'cdn' (or vice versa) to bypass a serving endpoint with a corrupted copy.","Manually verify the expected SHA-512 against the release manifest; if the checksums map is stale, update it.","Check available disk space — a full disk can truncate the written file."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"import crypto from 'node:crypto'\nimport fs from 'node:fs'\n\nasync function verifySha512(filePath: string, expected: string): Promise<boolean> {\n  const buf = fs.readFileSync(filePath)\n  const hash = crypto.createHash('sha512').update(buf).digest('hex')\n  return hash === expected.toLowerCase()\n}\n\n// Before trusting a download, verify:\nif (!(await verifySha512(savePath, expectedChecksum))) {\n  // re-download from alternate source before the extension throws\n}","typeGuard":null,"tryCatchPattern":"try {\n  await downloadBackend(backend, version, source)\n} catch (e) {\n  if (e instanceof Error && e.message.includes('Checksum mismatch')) {\n    // Switch source and retry once\n    await downloadBackend(backend, version, source === 'github' ? 'cdn' : 'github')\n  } else {\n    throw e\n  }\n}","preventionTips":["Pin to a known-good version whose checksums are verified in your test suite.","Use a stable CDN endpoint for downloads in environments with unreliable GitHub access.","Log the observed vs expected checksum on failure for faster diagnosis."],"tags":["checksum","integrity","download","verification","network","typescript"],"backgroundTag":null,"analyzedSha":"fad3f12a147d138388a66f0d92a02b2675f65294","analyzedAt":"2026-08-12T20:33:47.516Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}