{"record":{"id":"f525a334d9f8e92e","repo":"chocolatey/choco","slug":"package-hash-0-did-not-match-expected-hash-1","errorCode":null,"errorMessage":"Package hash '{0}' did not match expected hash '{1}'.","messagePattern":"Package hash '(.+?)' did not match expected hash '(.+?)'\\.","errorType":"exception","errorClass":"InvalidDataException","httpStatus":null,"severity":"error","filePath":"src/chocolatey/infrastructure.app/services/NugetService.cs","lineNumber":3290,"sourceCode":"                    using (var metadataFileStream = downloadResult.PackageReader.GetStream(PackagingCoreConstants.NupkgMetadataFileExtension))\r\n                    {\r\n                        var metadataFileContents = NupkgMetadataFileFormat.Read(metadataFileStream,\r\n                                                                                _nugetLogger,\r\n                                                                                PackagingCoreConstants.NupkgMetadataFileExtension);\r\n\r\n                        var metadataFileHashInfo = HashConverter.ConvertHashToHex(metadataFileContents.ContentHash);\r\n\r\n                        if (hashInfo.ConvertedHash.Equals(metadataFileHashInfo.ConvertedHash, StringComparison.OrdinalIgnoreCase))\r\n                        {\r\n                            this.Log().Debug(\"Package hash matches expected hash.\");\r\n                        }\r\n                        else\r\n                        {\r\n                            var errorMessage = \"Package hash '{0}' did not match expected hash '{1}'.\"\r\n                                    .FormatWith(metadataFileContents.ContentHash,\r\n                                                hashInfo.ConvertedHash);\r\n\r\n                            throw new InvalidDataException(errorMessage);\r\n                        }\r\n                    }\r\n                }\r\n                else\r\n                {\r\n                    this.Log().Warn(\"Source is not providing a SHA512 hash, cannot validate package hash.\");\r\n                }\r\n            }\r\n        }\r\n\r\n#pragma warning disable IDE0022, IDE1006\r\n        [Obsolete(\"This overload is deprecated and will be removed in v3.\")]\r\n        public void ensure_source_app_installed(ChocolateyConfiguration config, Action<PackageResult, ChocolateyConfiguration> ensureAction)\r\n            => EnsureSourceAppInstalled(config, ensureAction);\r\n\r\n        [Obsolete(\"This overload is deprecated and will be removed in v3.\")]\r\n        public virtual int count_run(ChocolateyConfiguration config)\r\n            => Count(config);\r","sourceCodeStart":3272,"sourceCodeEnd":3308,"githubUrl":"https://github.com/chocolatey/choco/blob/0d5abdd10cc177a141e69547cad6935b419b6c17/src/chocolatey/infrastructure.app/services/NugetService.cs#L3272-L3308","documentation":"ValidatePackageHash compares the downloaded package's hash (from metadataFileContents.ContentHash) against the source-advertised hash. When the converted hashes do not match case-insensitively, it throws InvalidDataException with the actual and expected hash values. A missing SHA512 from the source only logs a warning and does not throw.","triggerScenarios":"The computed/recorded hash of the downloaded nupkg differs from the SHA512 advertised by the source; the equality check (hashInfo.ConvertedHash vs metadataFileHashInfo.ConvertedHash, OrdinalIgnoreCase) fails.","commonSituations":"Network/proxy corruption altering bytes; a partially cached nupkg; a republished package whose hash metadata was not updated; man-in-the-middle tampering with the download.","solutions":["Clear the local NuGet/Chocolatey cache and re-download the package","Verify network stability and disable any corrupting proxy","Confirm the source's advertised hash matches the actual nupkg (contact the feed admin)","Re-download the .nupkg and compute its SHA512 manually to compare against the expected value"],"exampleFix":"// before\nchoco install mypkg\n// after\nchoco cache remove\nchoco install mypkg","handlingStrategy":"retry","validationCode":"// Clear the cache before install when hash mismatches are suspected.\nif (!config.CacheLocation.IsNullOrWhiteSpace()) choco.ClearCache();\n// Optionally pre-download and verify the nupkg SHA512 against the source hash.","typeGuard":null,"tryCatchPattern":"int attempts = 0;\nretry:\ntry { choco.Install(config); }\ncatch (InvalidDataException ex) when (ex.Message.Contains(\"did not match expected hash\") && attempts++ < 2) {\n    choco.ClearCache(); goto retry;\n}","preventionTips":["Clear the cache before retrying a hash-mismatch failure","Use a trusted source and HTTPS to avoid in-transit corruption","Disable corrupting proxies and verify network integrity for large downloads"],"tags":["hash","security","download","install"],"backgroundTag":null,"analyzedSha":"0d5abdd10cc177a141e69547cad6935b419b6c17","analyzedAt":"2026-08-13T18:33:03.301Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}