{"record":{"id":"8d550f2a411b7bf8","repo":"xtekky/gpt4free","slug":"sha256-mismatch-got-s-want-s","errorCode":null,"errorMessage":"sha256 mismatch: got %s, want %s","messagePattern":"sha256 mismatch: got (.+?), want (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"g4f-go/download.go","lineNumber":169,"sourceCode":"}\n\n// verifyRuntime validates sha256 when pinned in the manifest.\nfunc verifyRuntime(cachePath string, spec *RuntimeSpec) error {\n\tif spec.SHA256 == \"\" {\n\t\treturn nil // unpinned; trust size/transport\n\t}\n\tf, err := os.Open(cachePath)\n\tif err != nil {\n\t\treturn err\n\t}\n\tdefer f.Close()\n\th := sha256.New()\n\tif _, err := io.Copy(h, f); err != nil {\n\t\treturn err\n\t}\n\tgot := hex.EncodeToString(h.Sum(nil))\n\tif !strings.EqualFold(got, spec.SHA256) {\n\t\treturn fmt.Errorf(\"sha256 mismatch: got %s, want %s\", got, spec.SHA256)\n\t}\n\tfmt.Println(\"runtime: sha256 verified\")\n\treturn nil\n}\n\n// copyWithProgress streams r into w while printing a \\r-updated progress bar.\nfunc copyWithProgress(w io.Writer, r io.Reader, total int64, start time.Time) (int64, error) {\n\tbuf := make([]byte, 256*1024)\n\tvar written int64\n\tlastPrint := time.Time{}\n\tfor {\n\t\tn, err := r.Read(buf)\n\t\tif n > 0 {\n\t\t\tif _, werr := w.Write(buf[:n]); werr != nil {\n\t\t\t\treturn written, werr\n\t\t\t}\n\t\t\twritten += int64(n)\n\t\t\t// Throttle progress output to ~5 updates/sec.","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/xtekky/gpt4free/blob/973504e1770928ed5fb82f43da528f441ad9ddc3/g4f-go/download.go#L151-L187","documentation":"verifyRuntime in g4f-go/download.go hashes the downloaded archive with sha256 and compares (case-insensitively) against spec.SHA256 pinned in runtime.json. A mismatch means the bytes on disk are not the bytes the manifest author signed — corrupted download, silently altered artifact, or a stale manifest hash after the artifact changed.","triggerScenarios":"A bit-flipped/truncated download that still passed the size check; the upstream asset was rebuilt without updating sha256 in runtime.json; a compromised or mis-mirrored CDN serving different content; an empty field would skip, so this only fires when a hash IS pinned.","commonSituations":"Re-published release assets; third-party mirrors injecting wrappers; flaky storage corrupting the cached file; hand-edited manifests.","solutions":["Compute the actual hash (sha256sum <cachePath>) and compare with runtime.json — if the official artifact matches your download, the manifest hash is stale: update it","Delete the cached archive and re-download to rule out corruption in transit","Download only from the official URL in the upstream repo; distrust mirrors after a mismatch","If you publish runtimes yourself, always regenerate both size and sha256 together when the artifact changes"],"exampleFix":"# before\n# sha256 mismatch: got ab12..., want cd34...\n\n# after\nsha256sum .g4f-runtime/runtime-*.tar.gz        # got\n# verify against the official release notes; if the download is the official one:\n# edit runtime.json -> replace sha256 with the verified value\nrm .g4f-runtime/runtime-*.tar.gz               # force clean re-download if corrupted","handlingStrategy":"validation","validationCode":"sum, err := sha256sum(cachePath)\nif err == nil && !strings.EqualFold(sum, spec.SHA256) {\n    // corrupted or tampered artifact: discard before extraction\n}","typeGuard":null,"tryCatchPattern":"err := downloadRuntime(binDir, cachePath, spec)\nif err != nil && strings.Contains(err.Error(), \"sha256 mismatch\") {\n    // delete cache, re-verify against the official published hash,\n    // update the manifest only if upstream legitimately re-signed\n}","preventionTips":["Always pin sha256 in runtime.json (empty hash skips verification)","Download runtimes only from the official, HTTPS-pinned URL","Treat a mismatch as a security event first, a stale manifest second"],"tags":["go","integrity","sha256","security","download"],"backgroundTag":null,"analyzedSha":"973504e1770928ed5fb82f43da528f441ad9ddc3","analyzedAt":"2026-08-14T23:45:32.408Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}