{"record":{"id":"f342b745cfe56fe1","repo":"denoland/deno","slug":"checksum-verification-failed-actual-exp","errorCode":null,"errorMessage":"Checksum verification failed.\n  Actual:   {}\n  Expected: {}","messagePattern":"Checksum verification failed\\.\n  Actual:   (.+?)\n  Expected: (.+?)","errorType":"exception","errorClass":"AnyError","httpStatus":null,"severity":"critical","filePath":"cli/tools/upgrade.rs","lineNumber":1910,"sourceCode":"  // text above which will stay alive after the progress bars are complete\n  let progress = progress_bar.update(\"\");\n  let response = client\n    .download_with_progress_and_retries(download_url.clone(), &Default::default(), &progress)\n    .await\n    .with_context(|| format!(\"Failed downloading {download_url}. The version you requested may not have been built for the current architecture.\"))?;\n  Ok(response.into_maybe_bytes()?)\n}\n\nfn verify_checksum(\n  data: &[u8],\n  expected_checksum: &str,\n) -> Result<(), AnyError> {\n  let computed = sha2::Sha256::digest(data);\n  let computed_hex = faster_hex::hex_string(&computed);\n\n  let expected_checksum = expected_checksum.trim().to_lowercase();\n  if computed_hex != expected_checksum {\n    bail!(\n      \"Checksum verification failed.\\n  Actual:   {}\\n  Expected: {}\",\n      expected_checksum,\n      computed_hex\n    );\n  }\n\n  log::info!(\"{}\", colors::gray(\"Checksum verified\"));\n  Ok(())\n}\n\nfn replace_exe(from: &Path, to: &Path) -> Result<(), std::io::Error> {\n  if cfg!(windows) {\n    // On windows you cannot replace the currently running executable.\n    // so first we rename it to deno.old.exe\n    fs::rename(to, to.with_extension(\"old.exe\"))?;\n  } else {\n    fs::remove_file(to)?;\n  }","sourceCodeStart":1892,"sourceCodeEnd":1928,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/cli/tools/upgrade.rs#L1892-L1928","documentation":"Every downloaded upgrade archive is verified against its published SHA-256 checksum (`*.sha256` file). This error means the hex digest of the downloaded bytes did not match the expected value, so the archive is corrupt or was altered, and Deno refuses to install it. Note: in current code the two labels are swapped — the value printed as 'Actual' is the expected checksum string and 'Expected' is the locally computed digest — so read the pair as 'published vs computed'.","triggerScenarios":"Truncated/corrupted download (dropped connection, proxy mangling bytes); a CDN/mirror serving stale or wrong archive for the version's checksum; disk corruption; theoretically a tampered download. Comparison happens after lowercasing/trimming the expected value at cli/tools/upgrade.rs:1910.","commonSituations":"Flaky networks or corporate proxies that modify HTTPS bodies; system clocks/antivirus interfering with the download; downloading a version whose archive was re-uploaded with a different checksum.","solutions":["Re-run `deno upgrade` — most checksum failures are truncated transfers that a fresh download fixes.","If it persists, download the archive manually, verify its sha256 against the published `.sha256` file, and install by hand.","Disable/inspect HTTP-altering proxies, VPNs, or antivirus HTTPS inspection for dl.deno.dev.","Report it if a manual download also mismatches the published checksum (publishing-side issue)."],"exampleFix":"# before\ndeno upgrade  # Checksum verification failed. Actual: ... Expected: ...\n\n# after: manual verify + install\ncurl -O https://dl.deno.land/release/v1.44.0/deno-x86_64-unknown-linux-gnu.zip\ncurl -O https://dl.deno.land/release/v1.44.0/deno-x86_64-unknown-linux-gnu.zip.sha256\nsha256sum -c deno-x86_64-unknown-linux-gnu.zip.sha256  # then unzip to your install dir","handlingStrategy":"retry","validationCode":"# verify manually before upgrading (mirrors the internal check)\nurl=https://dl.deno.land/release/v1.44.0/deno-x86_64-unknown-linux-gnu.zip\ncurl -fsS -o d.zip \"$url\" && curl -fsS -o d.zip.sha256 \"$url.sha256\"\necho \"$(cat d.zip.sha256)  d.zip\" | sha256sum -c - || echo \"corrupt source — do not install\"","typeGuard":null,"tryCatchPattern":"for i in 1 2 3; do deno upgrade && break || { echo \"checksum failed — retry $i\"; sleep 10; }; done","preventionTips":["Retry upgrades on checksum failure — most are truncated downloads.","Bypass HTTPS-inspecting proxies/antivirus for dl.deno.land.","Verify the published .sha256 manually when a failure repeats; never force-install a mismatching archive."],"tags":["upgrade","checksum","sha256","download","integrity"],"backgroundTag":"checksum-mismatch","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-08-31T04:17:50.494Z"}