{"record":{"id":"93d8dddb8114049e","repo":"nikivdev/code","slug":"checksum-mismatch-for","errorCode":null,"errorMessage":"checksum mismatch for {}","messagePattern":"checksum mismatch for (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/registry.rs","lineNumber":249,"sourceCode":"    let path = target_entry\n        .binaries\n        .get(&bin)\n        .with_context(|| format!(\"No binary '{}' in manifest\", bin))?;\n    let download_url = resolve_download_url(&registry_url, path);\n    let response = client\n        .get(download_url)\n        .send()\n        .context(\"failed to download binary\")?;\n    if !response.status().is_success() {\n        bail!(\"download failed ({})\", response.status());\n    }\n    let bytes = response.bytes().context(\"failed to read download\")?;\n\n    if !opts.no_verify {\n        if let Some(expected) = target_entry.sha256.get(&bin) {\n            let actual = sha256_bytes(&bytes);\n            if expected != &actual {\n                bail!(\"checksum mismatch for {}\", bin);\n            }\n        }\n    }\n\n    let bin_dir = opts.bin_dir.clone().unwrap_or_else(default_bin_dir);\n    fs::create_dir_all(&bin_dir)\n        .with_context(|| format!(\"failed to create {}\", bin_dir.display()))?;\n    let dest = bin_dir.join(&bin);\n    if dest.exists() && !opts.force {\n        bail!(\n            \"{} already exists (use --force to overwrite)\",\n            dest.display()\n        );\n    }\n\n    let mut temp = NamedTempFile::new_in(&bin_dir)\n        .with_context(|| format!(\"failed to create temp file in {}\", bin_dir.display()))?;\n    temp.write_all(&bytes)?;","sourceCodeStart":231,"sourceCodeEnd":267,"githubUrl":"https://github.com/nikivdev/code/blob/a747e741ae92c09071d0ae946ab48488adcff1ce/src/registry.rs#L231-L267","documentation":"install verifies downloaded binaries against the sha256 recorded in the registry manifest, unless --no-verify is passed. If the computed hash of the downloaded bytes differs from the expected hash for that binary, install aborts with 'checksum mismatch for <bin>' to protect against corrupted or tampered downloads.","triggerScenarios":"sha256_bytes(downloaded bytes) != target_entry.sha256[bin] during install (with verification enabled). Happens when the stored binary differs from the manifest hash.","commonSituations":"Partial/corrupted download through a proxy; registry manifest republished with binaries from a different build; man-in-the-middle tampering; a CDN serving a stale cached artifact.","solutions":["Retry the download — transient corruption is the most common cause.","Do NOT blindly use --no-verify; first re-publish the package so the manifest hash matches the binary if the publisher changed artifacts.","Check for proxy/CDN interference and clear caches.","If mismatch persists, treat the artifact as untrusted and alert the package publisher."],"exampleFix":"// before (dangerous workaround)\nmytool install --name mypkg --no-verify\n\n// after\nmytool install --name mypkg   # let sha256 verification run; republish if hashes are stale","handlingStrategy":"validation","validationCode":"// Verify checksum yourself before trusting the artifact (mirror of the library check)\nlet actual = sha256_bytes(&bytes);\nlet expected = target_entry.sha256.get(&bin)\n    .ok_or(\"no expected checksum recorded\")?;\nif expected != &actual {\n    return Err(\"downloaded artifact does not match manifest checksum; refusing to install\".into());\n}","typeGuard":null,"tryCatchPattern":"match install(opts) {\n    Err(e) if e.to_string().contains(\"checksum mismatch\") => {\n        eprintln!(\"Artifact integrity check failed: retry once; if it persists, republish the package or investigate tampering. Do NOT use --no-verify.\");\n        std::process::exit(1);\n    }\n    other => other,\n}","preventionTips":["Never install with --no-verify in CI or production.","Republish packages after rebuilding so manifest hashes match binaries.","Investigate proxies/CDNs that may serve stale or corrupted artifacts.","Treat persistent mismatches as a potential supply-chain attack and alert the publisher."],"tags":["security","checksum","download","integrity"],"backgroundTag":"checksum-mismatch","analyzedSha":"a747e741ae92c09071d0ae946ab48488adcff1ce","analyzedAt":"2026-09-01T22:43:55.719Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}