{"record":{"id":"f9f8abbda1377b58","repo":"Yeachan-Heo/oh-my-codex","slug":"native-assets-checksum-mismatch-for-asset-arch","errorCode":null,"errorMessage":"[native-assets] checksum mismatch for ${asset.archive}","messagePattern":"\\[native-assets\\] checksum mismatch for (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"critical","filePath":"src/cli/native-assets.ts","lineNumber":739,"sourceCode":"      const asset = assets[index]!;\n      const archivePath = join(tempRoot, asset.archive);\n      const cachedBinaryPath = resolveCachedNativeBinaryPath(\n        product,\n        version,\n        platform,\n        arch,\n        env,\n        inferNativeAssetLibc(asset),\n      );\n      try {\n        await downloadFile(asset.download_url, archivePath);\n        const archiveStat = await stat(archivePath);\n        if (typeof asset.size === 'number' && asset.size > 0 && archiveStat.size !== asset.size) {\n          throw new Error(`[native-assets] downloaded archive size mismatch for ${asset.archive}`);\n        }\n        const digest = await sha256ForFile(archivePath);\n        if (digest !== asset.sha256) {\n          throw new Error(`[native-assets] checksum mismatch for ${asset.archive}`);\n        }\n\n        const archiveEntries = await inspectNativeArchive(archivePath);\n        const archiveBinary = selectNativeArchiveBinary(archiveEntries, asset.binary_path);\n        await writeSelectedNativeArchiveMember(archivePath, archiveBinary.path, extractedBinaryPath);\n\n        const published = await publishManagedNativeBinary(extractedBinaryPath, cachedBinaryPath, platform, env);\n        if (published) return published;\n        throw new Error(`[native-assets] cache publication verification failed for ${cachedBinaryPath}`);\n      } catch (error) {\n        if (index < assets.length - 1 && isUnavailableArchiveError(error)) {\n          await rm(archivePath, { force: true });\n          await rm(extractedBinaryPath, { force: true });\n          continue;\n        }\n        throw error;\n      }\n    }","sourceCodeStart":721,"sourceCodeEnd":757,"githubUrl":"https://github.com/Yeachan-Heo/oh-my-codex/blob/3ad79a8a6fe6e95fdbb8c00e40716fffe4011ce2/src/cli/native-assets.ts#L721-L757","documentation":"The SHA-256 of the downloaded archive does not match asset.sha256 from the release manifest. This is the cryptographic integrity gate; a mismatch means the bytes are not what the publisher shipped (corruption, MITM on plain HTTP, or a mismatched manifest/asset pair).","triggerScenarios":"hydrateNativeBinary when sha256ForFile(archivePath) !== asset.sha256 — corrupted transfer, mirror serving different bytes, or manifest checksums regenerated against different asset builds.","commonSituations":"HTTP (not HTTPS) mirrors tampering with artifacts; interrupted downloads resumed incorrectly; release automation uploading assets after writing the manifest.","solutions":["Re-download from the official GitHub release URL over HTTPS.","Verify manually: sha256sum <archive> vs the manifest value to distinguish corruption from a bad release.","If consistently mismatched from the official URL, the release assets are bad — pin a known-good version or re-publish."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"import { createHash } from 'node:crypto';\nimport { readFile } from 'node:fs/promises';\nasync function sha256(p: string): Promise<string> { return createHash('sha256').update(await readFile(p)).digest('hex'); }\n// compare against manifest asset.sha256 before trusting a mirrored archive","typeGuard":null,"tryCatchPattern":"try { await hydrateNativeBinary(); } catch (e) { if (/checksum mismatch for/.test(String(e))) { /* fetch from official HTTPS release URL; if it still fails, the release is bad — pin another version */ } throw e; }","preventionTips":["Only download over HTTPS from official release hosts","Pin versions whose releases are verified","Report persistent mismatches — never bypass the check"],"tags":["native-assets","checksum","sha256","integrity","tampering"],"backgroundTag":"checksum-mismatch","analyzedSha":"3ad79a8a6fe6e95fdbb8c00e40716fffe4011ce2","analyzedAt":"2026-08-27T22:18:39.783Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}