{"record":{"id":"de4059fdeb9ef88f","repo":"oraios/serena","slug":"checksum-verification-failed-for-file-path-ex","errorCode":null,"errorMessage":"Checksum verification failed for '{file_path}': expected {expected_sha256}, got {actual_sha256}","messagePattern":"Checksum verification failed for '(.+?)': expected (.+?), got (.+?)","errorType":"exception","errorClass":"SolidLSPException","httpStatus":null,"severity":"critical","filePath":"src/solidlsp/ls_utils.py","lineNumber":572,"sourceCode":"        Calculates the SHA256 checksum of a file.\n        \"\"\"\n        sha256_hash = hashlib.sha256()\n        with open(file_path, \"rb\") as input_file:\n            for chunk in iter(lambda: input_file.read(8192), b\"\"):\n                sha256_hash.update(chunk)\n        return sha256_hash.hexdigest()\n\n    @staticmethod\n    def _verify_sha256_if_configured(file_path: str, expected_sha256: str | None) -> None:\n        \"\"\"\n        Verifies the SHA256 checksum of a file when an expected value is provided.\n        \"\"\"\n        if expected_sha256 is None:\n            return\n\n        actual_sha256 = FileUtils.calculate_sha256(file_path)\n        if actual_sha256.lower() != expected_sha256.lower():\n            raise SolidLSPException(f\"Checksum verification failed for '{file_path}': expected {expected_sha256}, got {actual_sha256}\")\n\n    @staticmethod\n    def _validate_download_host(url: str, allowed_hosts: Sequence[str] | None) -> None:\n        \"\"\"\n        Validates that a download URL resolves to one of the configured hosts.\n        \"\"\"\n        if not allowed_hosts:\n            return\n\n        hostname = urlparse(url).hostname\n        normalized_allowed_hosts = {host.lower() for host in allowed_hosts}\n        if hostname is None or hostname.lower() not in normalized_allowed_hosts:\n            raise SolidLSPException(\n                f\"Refusing to download from host '{hostname or '<unknown>'}'; allowed hosts: {sorted(normalized_allowed_hosts)}\"\n            )\n\n    @staticmethod\n    def _validate_extraction_path(member_name: str, target_path: str) -> str:","sourceCodeStart":554,"sourceCodeEnd":590,"githubUrl":"https://github.com/oraios/serena/blob/7fcbca7e62555ec2287ddb2f083caee805848ea6/src/solidlsp/ls_utils.py#L554-L590","documentation":"Raised by FileUtils._verify_sha256_if_configured after a verified download: the SHA-256 of the downloaded file does not match the configured expected hash. This is a safety check ensuring the language-server artifact was not corrupted or tampered with in transit.","triggerScenarios":"download_file_verified invoked with an expected_sha256 that does not match the actual file, e.g. the upstream artifact was updated/rebuilt while a pinned hash is stale, or the download was truncated.","commonSituations":"Pinned checksums in config go stale after upstream releases a new build; CDN serves a different variant (e.g. different architecture); proxy injects content.","solutions":["Recompute the artifact hash upstream and update the configured expected_sha256 to the new official value","Re-download the file; transient truncation produces wrong hashes","Verify you downloaded the exact variant (arch/OS) the hash was computed for"],"exampleFix":"// before\nexpected_sha256 = \"abc123...\"  # stale pin\n// after\nexpected_sha256 = sha256sum(language_server.zip)  # refreshed from release notes","handlingStrategy":"validation","validationCode":"import hashlib\nactual = hashlib.sha256(open(path, \"rb\").read()).hexdigest()\nif actual.lower() != expected_sha256.lower():\n    raise ValueError(f\"pre-download checksum mismatch: {actual}\")","typeGuard":null,"tryCatchPattern":"try:\n    download_file_verified(url, path, expected_sha256=expected)\nexcept SolidLSPException as e:\n    if \"Checksum verification failed\" in str(e):\n        refresh_expected_hash_from_release_notes()  # or fail hard\n    raise","preventionTips":["Pin hashes to immutable release assets, not latest URLs","Automate hash refresh from official release notes","Prefer HTTPS-only, allowlisted hosts to reduce tampering risk","Treat mismatch as a security event: do not bypass the check"],"tags":["checksum","security","download"],"backgroundTag":"checksum-mismatch","analyzedSha":"7fcbca7e62555ec2287ddb2f083caee805848ea6","analyzedAt":"2026-08-29T00:04:09.619Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}