{"record":{"id":"d8943f6b651bdc73","repo":"jdx/mise","slug":"verified-checksum-file-digest-does-not-match-expec","errorCode":null,"errorMessage":"verified checksum file digest does not match expected checksum for {artifact_filename}","messagePattern":"verified checksum file digest does not match expected checksum for (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/backend/aqua.rs","lineNumber":2068,"sourceCode":"    fn verify_checksum_file_matches_expected(\n        &self,\n        checksum_config: &AquaChecksum,\n        checksum_path: &Path,\n        artifact_filename: &str,\n        expected_checksum: Option<&str>,\n    ) -> Result<()> {\n        let checksum_content = file::read_to_string_bom(checksum_path)?;\n        let checksum_str = self.parse_checksum_from_content(\n            &checksum_content,\n            checksum_config,\n            artifact_filename,\n        )?;\n        let checksum_val = format!(\"{}:{}\", checksum_config.algorithm(), checksum_str);\n        if let Some(expected) = expected_checksum\n            && same_checksum_algorithm(expected, &checksum_val)\n            && expected != checksum_val\n        {\n            bail!(\n                \"verified checksum file digest does not match expected checksum for {artifact_filename}\"\n            );\n        }\n        Ok(())\n    }\n\n    pub(crate) fn from_arg(ba: BackendArg) -> Self {\n        let full = ba.full_without_opts();\n        let mut id = full.split_once(\":\").unwrap_or((\"\", &full)).1;\n        if !id.contains(\"/\") {\n            id = REGISTRY\n                .get(id)\n                .and_then(|t| t.backends.iter().find_map(|s| s.full.strip_prefix(\"aqua:\")))\n                .unwrap_or_else(|| {\n                    warn!(\"invalid aqua tool: {}\", id);\n                    id\n                });\n        }","sourceCodeStart":2050,"sourceCodeEnd":2086,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/backend/aqua.rs#L2050-L2086","documentation":"After verifying an aqua artifact's checksum via a checksum file, the computed digest of the checksum file itself is compared against an expected checksum when one is configured with the same algorithm. A mismatch means the checksum file (and hence possibly the artifact) differs from what was expected — a supply-chain/integrity guard — so the install aborts.","triggerScenarios":"Installing an aqua package where the config (or lockfile) pins an expected checksum for the checksum file, the algorithm matches the computed one, but the computed `algo:digest` string differs from the expected value.","commonSituations":"Upstream project re-uploaded or regenerated its checksums file for the same release tag; a proxy/mirror served a stale or tampered checksums file; the pin in mise.lock or package config was made for a different version/platform; typo when hand-pinning the expected checksum.","solutions":["Verify you are pinned to the intended version and that the expected checksum was copied correctly from the upstream release","Check the upstream release for a re-tag/re-upload; if checksums legitimately changed, update the pinned expected checksum in the lockfile/config","Retry later or use a different mirror in case of a corrupted download, then re-verify","Treat as a potential supply-chain issue: do not bypass; if you cannot confirm integrity, do not install the artifact"],"exampleFix":"# before (stale pin in mise.lock after upstream re-upload)\nchecksum = \"sha256:1111...\"\n# after: recompute from the verified upstream checksums file and update the pin\nchecksum = \"sha256:def4...\"","handlingStrategy":"try-catch","validationCode":"// Verify the pin against the upstream release before installing:\n// fetch the release's published checksums file and compare the expected digest\nlet upstream = fetch_checksums_file(release_tag).await?;\nif upstream.get(algorithm) != Some(&expected_digest) {\n    eprintln!(\"pinned checksum differs from upstream release; investigate before installing\");\n}","typeGuard":null,"tryCatchPattern":"match verify_checksum_file(&artifact, &expected) {\n    Err(e) if e.to_string().contains(\"does not match expected checksum\") => {\n        // treat as a potential supply-chain event: block the install and alert\n        report_integrity_failure(&artifact_filename, e);\n    }\n    r => r?,\n}","preventionTips":["Pin expected checksums in the lockfile and commit them; never accept checksums only from the same mirror as the artifact","When a release is re-tagged upstream, re-derive pins from the new official release assets","Investigate any mismatch rather than bypassing; it may indicate tampering or a compromised mirror","Keep mise updated so checksum algorithms and verification logic stay current"],"tags":["aqua","checksum","supply-chain"],"backgroundTag":"checksum-mismatch","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}