{"record":{"id":"f62db4f615e2f124","repo":"AutoDarkMode/Windows-Auto-Night-Mode","slug":"sha256-mismatch-expected-x-got-x","errorCode":null,"errorMessage":"sha256 mismatch: expected {:x?}, got {:x?}","messagePattern":"sha256 mismatch: expected (.+?), got (.+?)","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"critical","filePath":"adm-downloader-rs/src/main.rs","lineNumber":193,"sourceCode":"    let mut f = File::open(path)?;\r\n    let mut hasher = Sha256::new();\r\n    let mut buf = [0u8; 8192];\r\n    loop {\r\n        let n = f.read(&mut buf)?;\r\n        if n == 0 {\r\n            break;\r\n        }\r\n        hasher.update(&buf[..n]);\r\n    }\r\n    Ok(hasher.finalize().to_vec())\r\n}\r\n\r\nfn verify_sha256(url: &str, path: &PathBuf) -> anyhow::Result<()> {\r\n    let expected = fetch_expected_sha256(url)?;\r\n    let actual = compute_file_sha256(path)?;\r\n    if expected != actual {\r\n        let _ = remove_file(path);\r\n        anyhow::bail!(\r\n            \"sha256 mismatch: expected {:x?}, got {:x?}\",\r\n            expected,\r\n            actual\r\n        );\r\n    }\r\n    Ok(())\r\n}\r\n\r\n/// run the main download/verify/install flow. The installer's exit code (if run)\r\n/// is written into `installer_code`. On failure this returns one of the\r\n/// explicit error codes (ERR_DOWNLOAD, ERR_VERIFY, ERR_INSTALL_SPAWN).\r\nfn run_install_flow(\r\n    url: &str,\r\n    temp_path: &PathBuf,\r\n    installer_code: &mut Option<i32>,\r\n) -> Result<(), i32> {\r\n    // download\r\n    if let Err(e) = download_file(url, temp_path) {\r","sourceCodeStart":175,"sourceCodeEnd":211,"githubUrl":"https://github.com/AutoDarkMode/Windows-Auto-Night-Mode/blob/c15b28e92138a1baff6165bbca80842f06cb819f/adm-downloader-rs/src/main.rs#L175-L211","documentation":"Returned by verify_sha256 when the SHA-256 of the downloaded installer file does not equal the expected hash fetched from the .sha256 sidecar. On mismatch the downloaded file is deleted (remove_file) and the error is bailed, contributing to exit code ERR_VERIFY (13371). This is the integrity check that guards against corrupted or tampered downloads.","triggerScenarios":"verify_sha256(url, path): fetch_expected_sha256(url) returns expected bytes; compute_file_sha256(path) hashes the downloaded file in 8KB chunks; expected != actual triggers the bail at line 193 and remove_file.","commonSituations":"The download was truncated or corrupted by a network error/proxy; the .sha256 file corresponds to a different version/build than the asset URL; a MITM or compromised mirror altered the installer; antivirus modified the EXE after write; disk corruption; the hardcoded base URL and the checksum file drifted out of sync after a re-release.","solutions":["Re-download from a clean network path (no proxy/AV interference) and re-verify.","Confirm the asset URL and the .sha256 URL reference the exact same release/build.","Temporarily disable AV real-time scanning of the temp directory during download+verify.","If the mismatch persists across retries, treat the release as compromised and pin to a known-good version.","Compare the printed expected vs. got hashes against the project's published checksums manually."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// (Defense is the check itself.) Re-verify after a clean re-download:\nfn reverify(url: &str, path: &PathBuf) -> anyhow::Result<()> {\n    let expected = fetch_expected_sha256(url)?;\n    let actual = compute_file_sha256(path)?;\n    if expected != actual { anyhow::bail!(\"sha256 mismatch\"); }\n    Ok(())\n}","typeGuard":null,"tryCatchPattern":"// run_install_flow maps verify failures to ERR_VERIFY. On mismatch the file\n// is already deleted; surface a clear message and allow a fresh re-download:\nif let Err(e) = verify_sha256(url, temp_path) {\n    eprintln!(\"verify failed: {}\", e);\n    // optionally retry the whole download once before returning ERR_VERIFY\n    return Err(ERR_VERIFY);\n}","preventionTips":["Download over a clean, unproxied connection and re-verify before running the installer.","Ensure the asset URL and the .sha256 URL reference the same release/build.","Exclude the temp download directory from AV real-time scanning that could alter the EXE.","Treat persistent mismatches as a potential compromise — pin to a known-good release.","Manually compare the expected vs. got hashes against the project's published checksums."],"tags":["sha256","checksum","integrity","security","download","rust"],"backgroundTag":null,"analyzedSha":"c15b28e92138a1baff6165bbca80842f06cb819f","analyzedAt":"2026-08-13T21:04:56.049Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}