{"record":{"id":"d4cf7f9ebbe820be","repo":"kubernetes/kops","slug":"downloaded-from-q-but-hash-did-not-match-expected","errorCode":null,"errorMessage":"downloaded from %q but hash did not match expected %q","messagePattern":"downloaded from %q but hash did not match expected %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/http.go","lineNumber":135,"sourceCode":"\t\t}\n\tdefault:\n\t\treader, err := OpenURL(desturl)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tdefer reader.Close()\n\n\t\tif _, err := io.Copy(writer, reader); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error downloading HTTP content from %q: %v\", desturl, err)\n\t\t}\n\t}\n\n\tactual := &hashing.Hash{\n\t\tAlgorithm: algorithm,\n\t\tHashValue: hasher.Sum(nil),\n\t}\n\tif hash != nil && !actual.Equal(hash) {\n\t\treturn nil, fmt.Errorf(\"downloaded from %q but hash did not match expected %q\", desturl, hash)\n\t}\n\treturn actual, nil\n}\n\n// OpenURL opens a hardened HTTP GET stream for url.\nfunc OpenURL(url string) (io.ReadCloser, error) {\n\thttpClient := newDownloadHTTPClient()\n\n\tctx, cancel := context.WithTimeout(context.Background(), downloadTimeout)\n\treq, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)\n\tif err != nil {\n\t\tcancel()\n\t\treturn nil, fmt.Errorf(\"cannot create request: %v\", err)\n\t}\n\n\tresponse, err := httpClient.Do(req)\n\tif err != nil {\n\t\tcancel()","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/http.go#L117-L153","documentation":"Thrown at the end of downloadURLToWriter when the download completed but the computed hash of the received bytes does not equal the expected hash passed by the caller. This is content integrity validation: the file at the URL changed, the transfer was corrupted/truncated, or the pinned hash in the spec is outdated.","triggerScenarios":"Thrown at upup/pkg/fi/http.go:135 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["If the upstream artifact legitimately changed, update the pinned hash in the kOps spec/asset definition","Otherwise suspect a compromised or misconfigured mirror; re-download from the official source","Clear any cached partial download and retry on a stable connection","Verify by computing the hash of the URL content manually and comparing to the spec"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}