{"record":{"id":"ba932ed368d92af6","repo":"jdx/mise","slug":"checksum-mismatch-for-file-expected-algo-c","errorCode":null,"errorMessage":"Checksum mismatch for file {}:\nExpected: {algo}:{checksum}\nActual:   {algo}:{actual}","messagePattern":"Checksum mismatch for file (.+?):\nExpected: (.+?):(.+?)\nActual:   (.+?):(.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/hash.rs","lineNumber":134,"sourceCode":"                let out = cmd!(\"sha1sum\", path).read()?;\n                out.split_whitespace().next().unwrap().to_string()\n            } else {\n                file_hash_prog::<Sha1>(path, pr)?\n            }\n        }\n        \"md5\" => {\n            if use_external_hasher && file::which(\"md5sum\").is_some() {\n                let out = cmd!(\"md5sum\", path).read()?;\n                out.split_whitespace().next().unwrap().to_string()\n            } else {\n                file_hash_prog::<Md5>(path, pr)?\n            }\n        }\n        _ => bail!(\"Unknown checksum algorithm: {}\", algo),\n    };\n    let checksum = checksum.to_lowercase();\n    if actual != checksum {\n        bail!(\n            \"Checksum mismatch for file {}:\\nExpected: {algo}:{checksum}\\nActual:   {algo}:{actual}\",\n            display_path(path)\n        );\n    }\n    Ok(())\n}\n\npub(crate) fn parse_shasums(text: &str) -> HashMap<String, String> {\n    text.lines()\n        .filter_map(|l| {\n            let mut parts = l.split_whitespace();\n            let hash = parts.next()?;\n            let name = parts.next()?;\n            // Strip coreutils binary-mode marker (e.g. \"<hash> *file.tar.gz\").\n            let name = name.strip_prefix('*').unwrap_or(name);\n            Some((name.into(), hash.into()))\n        })\n        .collect()","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/hash.rs#L116-L152","documentation":"ensure_checksum compares the file's computed digest against the expected value; on mismatch it bails with a message showing the expected and actual digests side by side. This guards against corrupted or tampered downloads.","triggerScenarios":"ensure_checksum is called with a checksum that doesn't match the actual file contents — the file on disk differs from the recorded digest for the same algorithm.","commonSituations":"Interrupted or proxied download corrupting the artifact; upstream replaced a release artifact (rare but happens) invalidating pinned checksums; editing a file after checksum was recorded; wrong checksum copied from release notes (e.g. digest of a different platform's tarball).","solutions":["Delete the cached download and re-download — transient corruption is the most common cause.","Compare the printed Expected/Actual digests; if the actual is stable across redownloads, update your pinned checksum to the new value after verifying it against upstream.","Download from an official source or a different mirror if a proxy is altering content.","Verify you pinned the digest for the exact artifact (same version/platform), not a sibling file."],"exampleFix":"// before (stale pinned digest after upstream re-released)\nchecksum = \"sha256:deadbeef...\"\n// after re-downloading and verifying upstream digest\nchecksum = \"sha256:9f2c1a...\"","handlingStrategy":"retry","validationCode":"actual=$(sha256sum \"$file\" | cut -d' ' -f1)\n[ \"$actual\" = \"${expected#sha256:}\" ] || { rm -f \"$file\"; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Re-download on mismatch before changing any pinned value","Verify new digests against upstream release pages, never copy from the failed-download output","Pin digests for the exact artifact filename/version you install"],"tags":["checksum","integrity","download"],"backgroundTag":"checksum-mismatch","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}