{"record":{"id":"af25a96e2f97c3df","repo":"hashicorp/vagrant","slug":"the-checksum-of-the-downloaded-provider-provide","errorCode":null,"errorMessage":"The checksum of the downloaded provider '%{provider}' did not match the\nexpected value. If the problem persists, please install the provider\nmanually.\n\nExpected: %{expected}\nReceived: %{actual}","messagePattern":"The checksum of the downloaded provider '%(.+?)' did not match the\nexpected value\\. If the problem persists, please install the provider\nmanually\\.\n\nExpected: %(.+?)\nReceived: %(.+?)","errorType":"exception","errorClass":"Vagrant::Errors::ProviderChecksumMismatch","httpStatus":null,"severity":"error","filePath":"plugins/hosts/darwin/cap/provider_install_virtualbox.rb","lineNumber":39,"sourceCode":"        def self.provider_install_virtualbox(env)\n          path = Dir::Tmpname.create(\"vagrant-provider-install-virtualbox\") {}\n\n          # Prefixed UI for prettiness\n          ui = Vagrant::UI::Prefixed.new(env.ui, \"\")\n\n          # Start by downloading the file using the standard mechanism\n          ui.output(I18n.t(\n            \"vagrant.hosts.darwin.virtualbox_install_download\",\n            version: VERSION))\n          ui.detail(I18n.t(\n            \"vagrant.hosts.darwin.virtualbox_install_detail\"))\n          dl = Vagrant::Util::Downloader.new(URL, path, ui: ui)\n          dl.download!\n\n          # Validate that the file checksum matches\n          actual = FileChecksum.new(path, Digest::SHA2).checksum\n          if actual != SHA256SUM\n            raise Vagrant::Errors::ProviderChecksumMismatch,\n              provider: \"virtualbox\",\n              actual: actual,\n              expected: SHA256SUM\n          end\n\n          # Launch it\n          ui.output(I18n.t(\n            \"vagrant.hosts.darwin.virtualbox_install_install\"))\n          ui.detail(I18n.t(\n            \"vagrant.hosts.darwin.virtualbox_install_install_detail\"))\n          script = File.expand_path(\"../../scripts/install_virtualbox.sh\", __FILE__)\n          result = Vagrant::Util::Subprocess.execute(\"bash\", script, path)\n          if result.exit_code != 0\n            raise Vagrant::Errors::ProviderInstallFailed,\n              provider: \"virtualbox\",\n              stdout: result.stdout,\n              stderr: result.stderr\n          end","sourceCodeStart":21,"sourceCodeEnd":57,"githubUrl":"https://github.com/hashicorp/vagrant/blob/35f3160f4ad6edc3a9f3aa9570adfc1a4d73aaa5/plugins/hosts/darwin/cap/provider_install_virtualbox.rb#L21-L57","documentation":"Vagrant::Errors::ProviderChecksumMismatch is raised by the macOS host capability that auto-installs VirtualBox (plugins/hosts/darwin/cap/provider_install_virtualbox.rb:39). After `Vagrant::Util::Downloader` fetches the installer, Vagrant computes its SHA-256 with FileChecksum and compares it to the SHA256SUM constant pinned in the plugin; a mismatch aborts before the package is ever executed. This is an integrity guard against truncated, corrupted, or replaced downloads.","triggerScenarios":"`vagrant up` on macOS with no VirtualBox installed triggers automatic provider installation; the .dmg/.pkg downloads from the pinned virtualbox.org URL but `FileChecksum.new(path, Digest::SHA2).checksum != SHA256SUM` — a proxy mangling the body, a partial download on disk, or upstream re-publishing a different build at the URL this Vagrant release pinned.","commonSituations":"Corporate proxy or antivirus altering/stripping the downloaded binary; flaky network truncating a multi-hundred-MB file; disk full so the file is incomplete; a VirtualBox point release shipped under the same URL after the user's Vagrant was built, leaving the pinned checksum stale.","solutions":["Retry the install (re-run `vagrant up`) on a stable network — transient corruption is the most common cause","Install VirtualBox manually from virtualbox.org; when VirtualBox is already present, Vagrant skips auto-install entirely","Update Vagrant to the latest release so the pinned SHA256SUM matches the currently published artifact","If behind a proxy/AV, verify integrity yourself: `shasum -a 256 <downloaded file>` and compare with the error's Expected value"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"attempts = 0\nbegin\n  provider_install.call\nrescue Vagrant::Errors::ProviderChecksumMismatch => e\n  attempts += 1\n  warn \"download corrupted (expected #{e.data[:expected]}, got #{e.data[:actual]})\"\n  retry if attempts < 2   # one clean re-download\n  raise                   # then fall back to manual install\nend","preventionTips":["Pre-install VirtualBox on the base image/CI runner so auto-install never runs","Keep Vagrant updated so pinned checksums track published artifacts","On flaky links, download the installer yourself, verify SHA-256, then install manually"],"tags":["virtualbox","provider-install","checksum","macos","download"],"backgroundTag":"checksum-verification-failed","analyzedSha":"35f3160f4ad6edc3a9f3aa9570adfc1a4d73aaa5","analyzedAt":"2026-08-21T13:34:32.514Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}