{"record":{"id":"e2453d1078f0d9b2","repo":"github/copilot-sdk","slug":"checksum-mismatch-for-filename-expected-exp","errorCode":null,"errorMessage":"Checksum mismatch for {filename}:\n  expected: {expected_hash}\n  actual:   {actual}","messagePattern":"Checksum mismatch for (.+?):\n  expected: (.+?)\n  actual:   (.+?)","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"critical","filePath":"python/copilot/_cli_download.py","lineNumber":159,"sourceCode":"            \"If you are in an offline or firewalled environment, set \"\n            \"COPILOT_CLI_PATH to point to a manually-installed binary.\"\n        ) from exc\n\n    checksums: dict[str, str] = {}\n    for line in text.strip().splitlines():\n        parts = line.split()\n        if len(parts) == 2 and re.fullmatch(r\"[a-fA-F0-9]{64}\", parts[0]):\n            digest, filename = parts\n            # Some formats use *filename (binary mode indicator)\n            checksums[filename.lstrip(\"*\")] = digest.lower()\n    return checksums\n\n\ndef _verify_checksum(data: bytes, expected_hash: str, filename: str) -> None:\n    \"\"\"Verify SHA-256 checksum of downloaded data.\"\"\"\n    actual = hashlib.sha256(data).hexdigest()\n    if actual != expected_hash:\n        raise RuntimeError(\n            f\"Checksum mismatch for {filename}:\\n  expected: {expected_hash}\\n  actual:   {actual}\"\n        )\n\n\ndef _fetch_verified_release_package(version: str, runtime_platform: str) -> bytes:\n    \"\"\"Download and verify the unified platform release package.\"\"\"\n    asset_name = get_release_asset_name(version, runtime_platform)\n    expected_hash = _fetch_checksums(version).get(asset_name)\n    if not expected_hash:\n        raise RuntimeError(f\"SHA256SUMS.txt does not contain {asset_name}.\")\n    url = get_download_url(version, asset_name)\n    data = _fetch_url_bytes(url, timeout=600)\n    _verify_checksum(data, expected_hash, asset_name)\n    return data\n\n\ndef _runtime_bundle_is_complete(pair_dir: Path, wrapper_name: str) -> bool:\n    required = (","sourceCodeStart":141,"sourceCodeEnd":177,"githubUrl":"https://github.com/github/copilot-sdk/blob/cd8cf15dc3f9e762615790aaed0a771a0f392755/python/copilot/_cli_download.py#L141-L177","documentation":"_verify_checksum computes the SHA-256 hex digest of downloaded bytes and compares it to the published expected hash. On mismatch it raises this RuntimeError showing expected vs actual digests, guarding against corrupted or tampered downloads.","triggerScenarios":"_fetch_verified_release_package downloads a release package whose sha256 does not match the checksums file — interrupted/corrupted download, truncated body, or a mismatched version/package pair.","commonSituations":"Unstable network truncating large downloads; mirror serving stale artifacts; CDN caching an old package; MITM or tampering.","solutions":["Re-download the package (delete any cached copy first) and retry.","Verify the pinned version matches the checksums file version.","Switch networks/mirrors to rule out a corrupted transfer path.","Set COPILOT_CLI_PATH to a manually installed, independently verified binary.","If tampering is suspected, re-fetch checksums from the official release source."],"exampleFix":"# before\nassert hashlib.sha256(data).hexdigest() == expected_hash  # fails\n# after\nimport hashlib\nif hashlib.sha256(data).hexdigest() != expected_hash:\n    data = refetch_package(version)  # retry download, then re-verify","handlingStrategy":"retry","validationCode":"import hashlib\nif hashlib.sha256(data).hexdigest() != expected_hash:\n    raise RuntimeError(\"checksum mismatch — re-download required\")","typeGuard":null,"tryCatchPattern":"for attempt in range(3):\n    try:\n        data = download_package(version, platform)\n        _verify_checksum(data, expected_hash, filename)\n        break\n    except RuntimeError:\n        if attempt == 2: raise","preventionTips":["Delete cached downloads before retrying","Verify pinned versions match published checksums","Use official mirrors only","Independently verify binaries when setting COPILOT_CLI_PATH","Investigate repeated mismatches as possible tampering"],"tags":["checksum","security","download","python"],"backgroundTag":"checksum-mismatch","analyzedSha":"cd8cf15dc3f9e762615790aaed0a771a0f392755","analyzedAt":"2026-09-09T18:32:31.973Z","contentChangedAt":"2026-09-09T18:32:31.973Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}