{"record":{"id":"d8943f6b651bdc73","repo":"jdx/mise","slug":"verified-checksum-file-digest-does-not-match-expec","errorCode":null,"errorMessage":"verified checksum file digest does not match expected checksum for {artifact_filename}","messagePattern":"verified checksum file digest does not match expected checksum for (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/backend/aqua.rs","lineNumber":1993,"sourceCode":"    fn verify_checksum_file_matches_expected(\n        &self,\n        checksum_config: &AquaChecksum,\n        checksum_path: &Path,\n        artifact_filename: &str,\n        expected_checksum: Option<&str>,\n    ) -> Result<()> {\n        let checksum_content = file::read_to_string_bom(checksum_path)?;\n        let checksum_str = self.parse_checksum_from_content(\n            &checksum_content,\n            checksum_config,\n            artifact_filename,\n        )?;\n        let checksum_val = format!(\"{}:{}\", checksum_config.algorithm(), checksum_str);\n        if let Some(expected) = expected_checksum\n            && same_checksum_algorithm(expected, &checksum_val)\n            && expected != checksum_val\n        {\n            bail!(\n                \"verified checksum file digest does not match expected checksum for {artifact_filename}\"\n            );\n        }\n        Ok(())\n    }\n\n    pub(crate) fn from_arg(ba: BackendArg) -> Self {\n        let full = ba.full_without_opts();\n        let mut id = full.split_once(\":\").unwrap_or((\"\", &full)).1;\n        if !id.contains(\"/\") {\n            id = REGISTRY\n                .get(id)\n                .and_then(|t| t.backends.iter().find_map(|s| s.full.strip_prefix(\"aqua:\")))\n                .unwrap_or_else(|| {\n                    warn!(\"invalid aqua tool: {}\", id);\n                    id\n                });\n        }","sourceCodeStart":1975,"sourceCodeEnd":2011,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/backend/aqua.rs#L1975-L2011","documentation":"verify_checksum_file_matches_expected verifies that the artifact's checksum file digest matches the checksum recorded at lock time. When an expected checksum exists, uses the same algorithm, and the computed `algo:hex` value differs, it bails — meaning the downloaded artifact or its checksum file does not match what was locked/verified previously (possible corruption or tampering).","triggerScenarios":"verify_provenance_at_lock_time computes a digest for artifact_filename and compares it to the expected `algorithm:hash` string; any mismatch in the same-algorithm comparison raises the error. Also exercised by test_verify_checksum_file_reads_utf16.","commonSituations":"Upstream released new artifacts under the same version tag (release was re-tagged); CDN/proxy served a corrupted or different file; lockfile checksum copied from a different platform's artifact; MITM/tampering caught by provenance verification.","solutions":["Delete the cached/downloaded artifact and retry the install to rule out a corrupted download.","If the release was legitimately re-published, refresh the locked checksum (re-run the install/lock resolution and commit the updated mise.lock).","Verify the lockfile's expected checksum corresponds to the same platform's artifact, not another platform's.","If mismatch persists unexpectedly, treat it as a potential supply-chain issue and compare against upstream-signed provenance before proceeding."],"exampleFix":"# before\nmise.lock: checksum = \"sha256:abc123...\" (stale, release re-tagged)\nmise install --locked  # verified checksum file digest does not match expected checksum for example_1.0_Linux_x86_64.tar.gz\n# after\nrm -rf ~/.local/share/mise/downloads/aqua:owner/repo/1.0\nmise install && git add mise.lock && git commit -m \"chore: refresh mise.lock checksums\"","handlingStrategy":"retry","validationCode":"# shell: clear a possibly-corrupt cached download before reinstalling\nrm -rf \"$(mise where aqua:owner/repo 2>/dev/null || true)\" ~/.local/share/mise/downloads/aqua:owner/repo/*\nmise install","typeGuard":null,"tryCatchPattern":"retry_install_with_cache_clear(|| mise install, attempts: 2)\n// on repeated checksum-mismatch, stop and treat as a supply-chain signal:\n// compare against upstream-signed release provenance before trusting artifacts.","preventionTips":["Clear cached downloads after upstream re-tags a release.","Refresh mise.lock checksums when a release is legitimately republished.","Ensure the locked checksum corresponds to the same platform's artifact.","Treat persistent mismatches as potential tampering and verify provenance."],"tags":["aqua","checksum","security"],"backgroundTag":"checksum-mismatch","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}