{"record":{"id":"e9c248d7058ad2c1","repo":"k3s-io/k3s","slug":"failed-d-hash-verifications","errorCode":null,"errorMessage":"failed %d hash verifications","messagePattern":"failed (.+?) hash verifications","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/dataverify/dataverify.go","lineNumber":54,"sourceCode":"\tif err != nil {\n\t\treturn err\n\t}\n\tif len(sums) == 0 {\n\t\treturn fmt.Errorf(\"no entries found in %s\", sumListFile)\n\t}\n\tnumFailed := 0\n\tfor sumFile, sumExpected := range sums {\n\t\tfile := filepath.Join(root, sumFile)\n\t\tsumActual, _ := sha256Sum(file)\n\t\tif sumExpected != sumActual {\n\t\t\tlogrus.Errorf(\"Hash for file %s expected to be %s (fail)\", sumFile, sumExpected)\n\t\t\tnumFailed++\n\t\t} else {\n\t\t\tlogrus.Debugf(\"Verified hash %s is correct\", sumFile)\n\t\t}\n\t}\n\tif numFailed != 0 {\n\t\treturn fmt.Errorf(\"failed %d hash verifications\", numFailed)\n\t}\n\treturn nil\n}\n\n// VerifyLinks will take a file which contains a list of target links for files and verify they match\nfunc VerifyLinks(root, linkListFile string) error {\n\tlinks, err := fileMapFields(filepath.Join(root, linkListFile), 0, 1)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif len(links) == 0 {\n\t\treturn fmt.Errorf(\"no entries found in %s\", linkListFile)\n\t}\n\tnumFailed := 0\n\tfor linkFile, linkExpected := range links {\n\t\tfile := filepath.Join(root, linkFile)\n\t\tlinkActual, _ := os.Readlink(file)\n\t\tif linkExpected != linkActual {","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/dataverify/dataverify.go#L36-L72","documentation":"After parsing .sha256sums, VerifySums recomputes sha256 for each listed file and counts mismatches (mismatches are also logged per-file as 'Hash for file %s expected to be %s (fail)'). A non-zero count returns this error with the number of failed verifications - the extracted binaries do not match their signed checksums.","triggerScenarios":"One or more files in <data-dir>/data/<version>-tmp/bin have content differing from the sha256 recorded in .sha256sums (pkg/dataverify/dataverify.go:41-54). Note sha256Sum's own error is ignored, so a missing file counts as a mismatch too.","commonSituations":"Corrupted download/installation media; failing disk flipping bits; someone modified or replaced a binary in the bundle; untar interrupted midway leaving short files.","solutions":["Match the per-file 'Hash for file ... (fail)' log lines to identify the damaged files.","Remove <data-dir>/data/<version>-tmp and restart k3s to re-extract from the embedded bundle; if it fails again the binary itself is bad - reinstall from an official release and verify its checksum.","Run filesystem and disk diagnostics (fsck, smartctl) - repeated mismatches on different files indicate hardware failure."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Independently re-verify hashes before starting the node:\ncmd := exec.Command(\"sha256sum\", \"-c\", \".sha256sums\")\ncmd.Dir = filepath.Join(dataDir, \"data\", version, \"bin\")\nif out, err := cmd.CombinedOutput(); err != nil {\n    log.Fatalf(\"hash verification failed: %v\\n%s\", err, out)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Checksum-verify k3s downloads at install time.","Schedule periodic SMART/scrub checks on nodes holding etcd/data dirs.","Never hand-patch files inside the managed data dir."],"tags":["integrity","sha256","corruption","deployment","startup"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}