{"record":{"id":"c560350c43297245","repo":"twpayne/chezmoi","slug":"sha1-mismatch-expected-s-got-s","errorCode":null,"errorMessage":"SHA1 mismatch: expected %s, got %s","messagePattern":"SHA1 mismatch: expected (.+?), got (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/chezmoi/sourcestate.go","lineNumber":1723,"sourceCode":"\tif external.Checksum.RIPEMD160 != nil {\n\t\ts.warnFunc(\n\t\t\t\"%s: warning: insecure RIPEMD-160 checksum will be removed, use a secure hash like SHA256 instead\\n\",\n\t\t\texternalRelPath,\n\t\t)\n\t\tif gotRIPEMD160Sum := ripemd160Sum(data); !bytes.Equal(gotRIPEMD160Sum, external.Checksum.RIPEMD160) {\n\t\t\tformat := \"RIPEMD-160 mismatch: expected %s, got %s\"\n\t\t\terr := fmt.Errorf(format, external.Checksum.RIPEMD160, hex.EncodeToString(gotRIPEMD160Sum))\n\t\t\terrs = append(errs, err)\n\t\t}\n\t}\n\n\tif external.Checksum.SHA1 != nil {\n\t\ts.warnFunc(\n\t\t\t\"%s: warning: insecure SHA1 checksum will be removed, use a secure hash like SHA256 instead\\n\",\n\t\t\texternalRelPath,\n\t\t)\n\t\tif gotSHA1Sum := sha1Sum(data); !bytes.Equal(gotSHA1Sum, external.Checksum.SHA1) {\n\t\t\terr := fmt.Errorf(\"SHA1 mismatch: expected %s, got %s\", external.Checksum.SHA1, hex.EncodeToString(gotSHA1Sum))\n\t\t\terrs = append(errs, err)\n\t\t}\n\t}\n\n\tif external.Checksum.SHA256 != nil {\n\t\tif gotSHA256Sum := sha256.Sum256(data); !bytes.Equal(gotSHA256Sum[:], external.Checksum.SHA256) {\n\t\t\tformat := \"SHA256 mismatch: expected %s, got %s\"\n\t\t\terr := fmt.Errorf(format, external.Checksum.SHA256, hex.EncodeToString(gotSHA256Sum[:]))\n\t\t\terrs = append(errs, err)\n\t\t}\n\t}\n\n\tif external.Checksum.SHA384 != nil {\n\t\tif gotSHA384Sum := sha384Sum(data); !bytes.Equal(gotSHA384Sum, external.Checksum.SHA384) {\n\t\t\terrs = append(errs, fmt.Errorf(\"SHA384 mismatch: expected %s, got %s\",\n\t\t\t\texternal.Checksum.SHA384, hex.EncodeToString(gotSHA384Sum)))\n\t\t}\n\t}","sourceCodeStart":1705,"sourceCodeEnd":1741,"githubUrl":"https://github.com/twpayne/chezmoi/blob/f901167e4685db90da56d6a2a19df642cb3e0247/internal/chezmoi/sourcestate.go#L1705-L1741","documentation":"chezmoi verifies the downloaded external data against external.Checksum.SHA1. A mismatch between the declared SHA1 and sha1Sum(data) produces this error and is appended to the error list. SHA1 is considered insecure and its support will be removed; SHA256 is the recommended replacement.","triggerScenarios":"An external entry declares checksum.sha1; the downloaded bytes hash to a different digest than the declared one.","commonSituations":"Old configs pinned with SHA1 (common in legacy dotfiles repos); upstream replaced the artifact; hashing the decompressed file while chezmoi verifies the compressed download (or vice versa).","solutions":["Recompute: curl -sL <url> | sha1sum and update checksum.sha1.","Switch to checksum.sha256 for both security and future compatibility.","Ensure you hash the same byte stream chezmoi downloads (before decryption/decompression).","Remove the checksum if unverified download is acceptable."],"exampleFix":"// before\nchecksum.sha1 = \"2aae6c35c94fcfb415dbe95f408b9ce9\"\n// after\nchecksum.sha256 = \"<sha256sum of the artifact>\"","handlingStrategy":"validation","validationCode":"curl -sL \"$URL\" | sha1sum\n# Compare with checksum.sha1; prefer:\ncurl -sL \"$URL\" | sha256sum","typeGuard":null,"tryCatchPattern":"out, err := exec.Command(\"chezmoi\", \"apply\").CombinedOutput()\nif err != nil && strings.Contains(string(out), \"SHA1 mismatch\") {\n    return errors.New(\"update checksum.sha1 (or switch to sha256) in .chezmoiexternal\")\n}","preventionTips":["Hash the same byte stream chezmoi sees: pre-decrypt, pre-decompress.","Standardize on sha256 for all externals.","Re-pin checksums whenever you bump the artifact version."],"tags":["checksum","external","integrity","sha1"],"backgroundTag":"checksum-mismatch","analyzedSha":"f901167e4685db90da56d6a2a19df642cb3e0247","analyzedAt":"2026-09-01T18:16:41.508Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T01:17:15.007Z"}