{"record":{"id":"b61be850e3d01afa","repo":"apple/pkl","slug":"invaliddeclaredchecksum","errorCode":"invalidDeclaredChecksum","errorMessage":"ErrorMessages.create(\"invalidDeclaredChecksum\", packageUri.getDisplayName(), computedChecksums.getSha256(), expectedChecksums.getSha256())","messagePattern":"ErrorMessages\\.create\\(\"invalidDeclaredChecksum\", packageUri\\.getDisplayName\\(\\), computedChecksums\\.getSha256\\(\\), expectedChecksums\\.getSha256\\(\\)\\)","errorType":"error_code","errorClass":"PklException","httpStatus":null,"severity":"critical","filePath":"pkl-core/src/main/java/org/pkl/core/project/ProjectDependenciesResolver.java","lineNumber":109,"sourceCode":"          dependency.getPackageUri().toProjectPackageUri(), dependency.getChecksums());\n    }\n    for (var localDeclaredDependencies : declaredDependencies.localDependencies().values()) {\n      resolveDependencies(localDeclaredDependencies);\n    }\n  }\n\n  private void resolveDependenciesOfPackageUri(\n      PackageUri packageUri, @Nullable Checksums expectedChecksums) {\n    try {\n      if (alreadyHandledDependencies.contains(packageUri)) {\n        return;\n      }\n      var pair = packageResolver.getDependencyMetadataAndComputeChecksum(packageUri);\n      var metadata = pair.first;\n      var computedChecksums = pair.second;\n      if (expectedChecksums != null) {\n        if (!expectedChecksums.getSha256().equals(computedChecksums.getSha256())) {\n          throw new PklException(\n              ErrorMessages.create(\n                  \"invalidDeclaredChecksum\",\n                  packageUri.getDisplayName(),\n                  computedChecksums.getSha256(),\n                  expectedChecksums.getSha256()));\n        }\n      }\n      var dependencyWithChecksum = new RemoteDependency(packageUri, computedChecksums);\n      updateDependency(dependencyWithChecksum);\n      EconomicSets.add(alreadyHandledDependencies, packageUri);\n      for (var transitiveDependency : metadata.getDependencies().values()) {\n        resolveDependenciesOfPackageUri(\n            transitiveDependency.getPackageUri().toProjectPackageUri(),\n            transitiveDependency.getChecksums());\n      }\n    } catch (IOException | SecurityManagerException | PackageLoadError e) {\n      throw new PklException(e.getMessage(), e);\n    }","sourceCodeStart":91,"sourceCodeEnd":127,"githubUrl":"https://github.com/apple/pkl/blob/f3efcbfc9b60d30053b0536d664948d7aa1b8673/pkl-core/src/main/java/org/pkl/core/project/ProjectDependenciesResolver.java#L91-L127","documentation":"During dependency resolution, the SHA-256 checksum computed from the actually fetched package metadata does not match the checksum declared in the project's dependency checksums file. The resolver fails fast to protect against tampered or changed package contents.","triggerScenarios":"resolveDependenciesOfPackageUri (via buildResolvedDependencies) with expectedChecksums present whose sha256 differs from the checksum computed by packageResolver.getDependencyMetadataAndComputeChecksum().","commonSituations":"A remote package was republished/updated after checksums were generated; editing PklProjectDependencies by hand with a wrong/copy-pasted checksum; a man-in-the-middle or corrupted cache.","solutions":["Re-resolve dependencies to regenerate PklProjectDependencies with fresh checksums (e.g. pkl project resolve)","Verify the published package was not changed; republish with a new version instead of mutating an existing one","Clear the local package cache in case of a corrupted download","If the checksum is intentionally updated, update the expected checksum to the reported computed value"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { resolver.resolve(...); } catch (PklException e) { if (e.getMessage().contains(\"checksum\")) { /* regenerate checksums via pkl project resolve or verify package integrity */ } }","preventionTips":["Never edit PklProjectDependencies checksums by hand","Regenerate checksums after any dependency version bump","Verify published packages are immutable once released","Clear corrupted caches before re-resolving"],"tags":["checksum","security","dependency-resolution"],"backgroundTag":"checksum-mismatch","analyzedSha":"f3efcbfc9b60d30053b0536d664948d7aa1b8673","analyzedAt":"2026-09-08T13:10:45.570Z","contentChangedAt":"2026-09-08T13:10:45.570Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}