{"record":{"id":"ee7d0598f1a53646","repo":"crowdsecurity/crowdsec","slug":"w-the-index-file-is-invalid-please-run-cscli-h","errorCode":null,"errorMessage":"%w. The index file is invalid, please run 'cscli hub update' and try again","messagePattern":"%w\\. The index file is invalid, please run 'cscli hub update' and try again","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/cwhub/fetch.go","lineNumber":52,"sourceCode":"\ttee := io.TeeReader(reader, hash)\n\tif err := os.MkdirAll(dir, 0o755); err != nil {\n\t\treturn fmt.Errorf(\"while creating %s: %w\", dir, err)\n\t}\n\n\tf, err := os.OpenFile(destPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o600)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tdefer f.Close()\n\n\tif _, err := io.Copy(f, tee); err != nil {\n\t\treturn err\n\t}\n\n\tgotHash := hex.EncodeToString(hash.Sum(nil))\n\tif gotHash != wantHash {\n\t\treturn fmt.Errorf(\"%w. The index file is invalid, please run 'cscli hub update' and try again\",\n\t\t\tdownloader.HashMismatchError{\n\t\t\t\tExpected: wantHash,\n\t\t\t\tGot: gotHash,\n\t\t\t})\n\t}\n\n\treturn nil\n}\n\n// FetchContentTo writes the last version of the item's YAML file to the specified path.\n// If the file is embedded in the index file, it will be written directly without downloads.\n// Returns whether the file was downloaded (to inform if the security engine needs reloading)\n// and the remote url for feedback purposes.\nfunc (i *Item) FetchContentTo(ctx context.Context, contentProvider ContentProvider, destPath string) (bool, string, error) {\n\twantHash := i.latestHash()\n\tif wantHash == \"\" {\n\t\treturn false, \"\", fmt.Errorf(\"%s: latest hash missing from index. The index file is invalid, please run 'cscli hub update' and try again\", i.FQName())\n\t}","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/cwhub/fetch.go#L34-L70","documentation":"After writing the embedded content to disk, writeEmbeddedContentTo hashes the bytes (SHA-256) and compares against the expected hash from the index. On mismatch it returns a downloader.HashMismatchError wrapped with advice to refresh the index — the on-disk file was NOT overwritten with bad content only if the hash check precedes commit; here the file is already written but flagged invalid.","triggerScenarios":"Embedded base64 content in the hub index does not hash to i.latestHash(): stale index, hub-side publishing inconsistency, or base64 decode fallback producing different bytes than expected.","commonSituations":"Index file from an older `cscli hub update` while the hub published new content, interrupted index download, or a man-in-the-middle/corrupted mirror serving stale content.","solutions":["Run `sudo cscli hub update` to re-download a consistent index, then `sudo cscli hub upgrade-all`","Delete the index file and re-run `cscli hub update` if the mismatch persists","Verify network path to hub.crowdsec.net (proxy caching stale content)","Report to CrowdSec if a fresh index still mismatches"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"sum := sha256.Sum256([]byte(item.Content))\nwant, _ := hex.DecodeString(item.latestHash())\nif !bytes.Equal(sum[:], want) {\n    return fmt.Errorf(\"embedded content hash mismatch; refresh index first\")\n}","typeGuard":null,"tryCatchPattern":"var hm downloader.HashMismatchError\nif errors.As(err, &hm) {\n    logger.Errorf(\"hash mismatch for %s (want %s got %s); run 'cscli hub update'\", item.FQName(), hm.Expected, hm.Got)\n    return retryAfterIndexRefresh(ctx)\n}","preventionTips":["Run `cscli hub update` before `hub upgrade-all` so index and content are consistent","Avoid caching proxies that serve stale hub content","Re-run hub update when a hash mismatch occurs instead of forcing the install"],"tags":["hash","checksum","hub","index"],"backgroundTag":"checksum-mismatch","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}