{"record":{"id":"ba932ed368d92af6","repo":"jdx/mise","slug":"checksum-mismatch-for-file-expected-algo-c","errorCode":null,"errorMessage":"Checksum mismatch for file {}:\nExpected: {algo}:{checksum}\nActual:   {algo}:{actual}","messagePattern":"Checksum mismatch for file (.+?):\nExpected: (.+?):(.+?)\nActual:   (.+?):(.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/hash.rs","lineNumber":134,"sourceCode":"                let out = cmd!(\"sha1sum\", path).read()?;\n                out.split_whitespace().next().unwrap().to_string()\n            } else {\n                file_hash_prog::<Sha1>(path, pr)?\n            }\n        }\n        \"md5\" => {\n            if use_external_hasher && file::which(\"md5sum\").is_some() {\n                let out = cmd!(\"md5sum\", path).read()?;\n                out.split_whitespace().next().unwrap().to_string()\n            } else {\n                file_hash_prog::<Md5>(path, pr)?\n            }\n        }\n        _ => bail!(\"Unknown checksum algorithm: {}\", algo),\n    };\n    let checksum = checksum.to_lowercase();\n    if actual != checksum {\n        bail!(\n            \"Checksum mismatch for file {}:\\nExpected: {algo}:{checksum}\\nActual:   {algo}:{actual}\",\n            display_path(path)\n        );\n    }\n    Ok(())\n}\n\npub(crate) fn parse_shasums(text: &str) -> HashMap<String, String> {\n    text.lines()\n        .filter_map(|l| {\n            let mut parts = l.split_whitespace();\n            let hash = parts.next()?;\n            let name = parts.next()?;\n            // Strip coreutils binary-mode marker (e.g. \"<hash> *file.tar.gz\").\n            let name = name.strip_prefix('*').unwrap_or(name);\n            Some((name.into(), hash.into()))\n        })\n        .collect()","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/hash.rs#L116-L152","documentation":"After computing the file's actual digest, ensure_checksum compares it (lowercased) to the expected checksum and throws this error on any mismatch. It is a safety guard against corrupted or tampered downloads.","triggerScenarios":"ensure_checksum called with an expected checksum string that does not equal the actual digest of the file at `path` — corrupted download, truncated partial file, wrong file, or a stale expected checksum after upstream replaced the artifact.","commonSituations":"Flaky network or proxy corrupted a download; CDN served a newer build than the recorded checksum; manually written checksum in mise.toml taken from the wrong release; MITM tampering attempt.","solutions":["Delete the downloaded artifact (and mise's cache) and re-download, letting mise recompute the checksum","Verify the expected checksum against the official checksum file from the project's release page for that exact version","If upstream republished/changed the artifact, update the checksum in your config or update mise so the registry has the new value","Check for proxies/VPNs altering content; use a direct connection or different mirror","If the mismatch persists with an official checksum, treat the file as tampered and investigate the source"],"exampleFix":"// before\n# mise.toml\n[tools]\nnode = { version = \"22.3.0\", checksum = \"sha256:old_stale_hash...\" }\n// after\n# recompute from official release\n[tools]\nnode = { version = \"22.3.0\", checksum = \"sha256:current_official_hash...\" }","handlingStrategy":"retry","validationCode":"// compare against the official checksum file before installing\nlet expected: &str = &config_checksum;\nassert_eq!(expected.len(), 64, \"sha256 checksum should be 64 hex chars\");","typeGuard":null,"tryCatchPattern":"match ensure_checksum(&path, &algo, &expected) {\n    Err(e) if e.to_string().contains(\"Checksum mismatch\") => {\n        std::fs::remove_file(&path)?; // drop corrupt artifact\n        re_download(&url, &path)?;    // retry once, then compare with official sums\n    }\n    Err(e) => return Err(e),\n    Ok(()) => {},\n}","preventionTips":["Take expected checksums only from official release checksum files","Clear cached downloads after network interruptions","Be suspicious of persistent mismatches: verify TLS/proxy path before overriding"],"tags":["checksum","hash","integrity","security"],"backgroundTag":"checksum-mismatch","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}