{"record":{"id":"8bc163ce34bef3a6","repo":"hashicorp/packer","slug":"checksum-mismatch-for-s-expected-s-got-s","errorCode":null,"errorMessage":"checksum mismatch for %s: expected %s, got %s","messagePattern":"checksum mismatch for (.+?): expected (.+?), got (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"provisioner/hcp-sbom/packer_release_fetch.go","lineNumber":265,"sourceCode":"\t\t}()\n\n\t\tsumsContent, err := downloadChecksumFile(ctx, client, shaSumsURL)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to download release checksums: %w\", err)\n\t\t}\n\n\t\texpectedSHA, err := expectedZipSHA256FromSums(sumsContent, fileName)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to resolve expected checksum: %w\", err)\n\t\t}\n\n\t\tactualSHA, err := fileSHA256(candidateZipPath)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tif !strings.EqualFold(expectedSHA, actualSHA) {\n\t\t\treturn fmt.Errorf(\"checksum mismatch for %s: expected %s, got %s\", fileName, expectedSHA, actualSHA)\n\t\t}\n\n\t\t// Validate the expected binary exists inside the archive.\n\t\tbinaryName := \"packer\"\n\t\tif goos == \"windows\" {\n\t\t\tbinaryName = \"packer.exe\"\n\t\t}\n\n\t\tzr, err := zip.OpenReader(candidateZipPath)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to open downloaded zip: %w\", err)\n\t\t}\n\t\tdefer func() { _ = zr.Close() }()\n\n\t\tfoundBinary := false\n\t\tfor _, f := range zr.File {\n\t\t\tif f.Name == binaryName {\n\t\t\t\tfoundBinary = true","sourceCodeStart":247,"sourceCodeEnd":283,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/provisioner/hcp-sbom/packer_release_fetch.go#L247-L283","documentation":"Raised when the SHA256 of the downloaded Packer zip on disk does not (case-insensitively) match the expected hash from the official SHA256SUMS file. This is a supply-chain safety check: the downloaded artifact is treated as corrupt or tampered and the operation fails (and is retried up to 3 times).","triggerScenarios":"strings.EqualFold(expectedSHA, actualSHA) is false after computing actualSHA via fileSHA256(candidateZipPath) and expectedSHA via expectedZipSHA256FromSums(sumsContent, fileName).","commonSituations":"Truncated/corrupted download over a flaky connection; a middlebox or cache returning a different/older artifact; MITM or tampering attempt (the check is doing its job); comparing against a SHA256SUMS from a different version than the downloaded zip.","solutions":["Re-run the build: retries may fetch a clean copy if the corruption was transient.","Clear any HTTP caches/proxies between the build host and releases.hashicorp.com.","Verify the zip manually with sha256sum and compare against the SHA256SUMS entry.","If mismatches persist, treat as a security signal — verify over a trusted network and report suspected tampering."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"sum := sha256.Sum256(zipBytes)\nactual := hex.EncodeToString(sum[:])\nif !strings.EqualFold(actual, expectedSHA) {\n\treturn fmt.Errorf(\"download corrupt: expected %s got %s — do NOT use the artifact\", expectedSHA, actual)\n}","typeGuard":null,"tryCatchPattern":"if err := run(); err != nil {\n\tif strings.Contains(err.Error(), \"checksum mismatch\") {\n\t\t// treat as security-relevant: purge caches/proxies and redownload over a trusted path\n\t}\n}","preventionTips":["Never skip or override checksum verification","Purge HTTP caches/middleboxes that serve stale artifacts","Download over trusted networks; investigate repeated mismatches as possible tampering","Verify manually with sha256sum -c against SHA256SUMS"],"tags":["checksum","security","download","integrity"],"backgroundTag":"checksum-mismatch","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}