{"record":{"id":"b136ac850969b75a","repo":"jamiepine/voicebox","slug":"label-integrity-check-failed-expected-expected-b136ac","errorCode":null,"errorMessage":"{label} integrity check failed: expected {expected_sha[:16]}..., got {actual[:16]}...","messagePattern":"(.+?) integrity check failed: expected (.+?)\\.\\.\\., got (.+?)\\.\\.\\.","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"critical","filePath":"backend/services/rocm.py","lineNumber":213,"sourceCode":"        # Verify integrity\n        if expected_sha:\n            progress.update_progress(\n                PROGRESS_KEY,\n                current=progress_offset + downloaded,\n                total=total_size,\n                filename=f\"Verifying {label}...\",\n                status=\"downloading\",\n            )\n            sha256 = hashlib.sha256()\n            with open(temp_path, \"rb\") as f:\n                while True:\n                    data = f.read(1024 * 1024)\n                    if not data:\n                        break\n                    sha256.update(data)\n            actual = sha256.hexdigest()\n            if actual != expected_sha:\n                raise ValueError(\n                    f\"{label} integrity check failed: expected {expected_sha[:16]}..., got {actual[:16]}...\"\n                )\n            logger.info(f\"{label}: integrity verified\")\n\n        # Extract (use data filter for path traversal protection on Python 3.12+)\n        progress.update_progress(\n            PROGRESS_KEY,\n            current=progress_offset + downloaded,\n            total=total_size,\n            filename=f\"Extracting {label}...\",\n            status=\"downloading\",\n        )\n        with tarfile.open(temp_path, \"r:gz\") as tar:\n            tar.extractall(path=dest_dir, filter=\"data\")\n\n        logger.info(f\"{label}: extracted to {dest_dir}\")\n    finally:\n        if temp_path.exists():","sourceCodeStart":195,"sourceCodeEnd":231,"githubUrl":"https://github.com/jamiepine/voicebox/blob/51f49dea198384b4eb6087b72c17057c6eb1c1cd/backend/services/rocm.py#L195-L231","documentation":"Raised by the ROCm archive download helper after streaming the archive to disk: the computed SHA-256 of the downloaded temp file does not equal expected_sha parsed from the checksum file. A mismatch means the download is corrupt, truncated, or tampered with, and the helper aborts before extraction to prevent installing a bad backend.","triggerScenarios":"Network corruption truncating the archive mid-stream; a transparent proxy/CDN serving a partial or wrong file; the .sha256 file referenced a different build than the .tar.gz (release mismatch); disk write error producing a partial file; man-in-the-middle modification.","commonSituations":"Flaky connection dropping the stream; mirror/CDN caching a corrupt asset; release where the .sha256 was updated but the .tar.gz asset was not (or vice versa); disk-full during write; antivirus injecting itself into the stream.","solutions":["Re-run the download on a stable connection; delete any partial temp file in dest_dir first.","Verify the .tar.gz and .sha256 assets belong to the same release tag (compare filenames in the GitHub release).","If a proxy/CDN is corrupting the stream, bypass it or use a different network.","Free disk space on the destination volume.","Manually compute sha256sum on the downloaded file and compare to the published checksum to confirm the mismatch."],"exampleFix":"// before: integrity check fails after a truncated download\n// after: clean up and re-download\n# rm dest_dir/.download-*.tmp\n# sha256sum <archive>   # compare to published .sha256\n# re-run download_rocm_binary()","handlingStrategy":"retry","validationCode":"import hashlib, urllib.request\n\ndef expected_matches_local(archive_path: str, expected_sha: str) -> bool:\n    h = hashlib.sha256()\n    with open(archive_path, 'rb') as f:\n        for chunk in iter(lambda: f.read(1024*1024), b''):\n            h.update(chunk)\n    return h.hexdigest() == expected_sha","typeGuard":null,"tryCatchPattern":"for attempt in range(3):\n    try:\n        await download_verified_archive(client, url, sha256_url, dest_dir, label)\n        break\n    except ValueError as e:\n        if 'integrity check failed' in str(e) and attempt < 2:\n            # clear any partial temp file before retry\n            for p in dest_dir.glob('.download-*.tmp'):\n                p.unlink(missing_ok=True)\n            continue\n        raise","preventionTips":["Run downloads on a stable, non-throttled connection.","Confirm the .tar.gz and .sha256 come from the same release tag.","Free disk space and disable intrusive stream-intercepting proxies/AV."],"tags":["rocm","download","integrity","checksum","security","voicebox"],"backgroundTag":null,"analyzedSha":"51f49dea198384b4eb6087b72c17057c6eb1c1cd","analyzedAt":"2026-08-12T16:51:42.824Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}