apple/pkl · error · PklException

packageAlreadyPublishedWithDifferentContents

packageAlreadyPublishedWithDifferentContents

Error message

ErrorMessages.create("packageAlreadyPublishedWithDifferentContents", pkg.uri(), computedChecksum, receivedChecksum)

What it means

Thrown when packaging a project whose package is already published, but the SHA-256 checksum of the local contents does not match the checksum of the already-published package. Pkl refuses to re-publish because the published artifact would differ from what is already in the registry. This guards against accidental package mutation under the same name/version.

Solutions

Bump the package version in PklProject (e.g. 1.0.0 -> 1.0.1) and re-package
Revert the local changes so the package contents exactly match the published version
Verify the computed checksum is not affected by line-ending or build-environment differences and republish deliberately to a new version

Example fix

// before (PklProject)
package { version = "1.0.0" }
// after
package { version = "1.0.1" }

Defensive patterns

Strategy: validation

Validate before calling

// shell: compare local checksum with published one before packaging
pkl project package --dry-run 2>&1 || true
git status --porcelain   # ensure clean tree before publishing
# or programmatically: compute sha256 of the built zip and compare with the registry value

Try / catch

try { packager.package(project) } catch (PklException e) { if (e.message.contains("packageAlreadyPublishedWithDifferentContents")) bumpVersionAndRetry() else throw e }

Prevention

Always bump the version in PklProject before re-packaging after edits
Publish only from a clean git tree at a version tag
Avoid generated files with timestamps inside packaged content

When it happens

Trigger: Running `pkl project package` (doPackage) for a package name+version that already exists in the remote registry, after any file inside the package changed since it was first published.

Common situations: Editing Pkl files after publishing without bumping the package version; a dirty working tree or generated files differing from the original publish; building on a branch where package contents drifted from the release tag.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

AI-assisted analysis of apple/pkl@f3efcbfc9b (2026-09-08). Data as JSON: /api/errors/52fa94d30dfa5479. Report an issue: GitHub.

Appendix: source

Thrown at pkl-core/src/main/java/org/pkl/core/project/ProjectPackager.java:228

              metadataFile,
              metadataChecksumFile,
              zipFile,
              zipChecksumFile,
              metadataFileChecksum,
              null,
              null);
    }
    packageResults.put(pkg.uri(), result);
    return result;
  }

  private void checkAlreadyPublishedPackage(Package pkg, String computedChecksum)
      throws IOException {
    try {
      var metadataAndChecksum = packageResolver.getDependencyMetadataAndComputeChecksum(pkg.uri());
      var receivedChecksum = metadataAndChecksum.second.getSha256();
      if (!receivedChecksum.equals(computedChecksum)) {
        throw new PklException(
            ErrorMessages.create(
                "packageAlreadyPublishedWithDifferentContents",
                pkg.uri(),
                computedChecksum,
                receivedChecksum));
      }
    } catch (PackageLoadError e) {
      if (e.getMessageName().equals("badHttpStatusCode")) {
        var firstArg = e.getArguments()[0];
        assert firstArg != null;
        var statusCode = (int) firstArg;
        if (statusCode == 404) {
          return;
        } else {
          throw new PklException(
              ErrorMessages.create(
                  "unableToAccessPublishedPackage", pkg.name(), pkg.packageZipUrl(), statusCode));
        }

View on GitHub (pinned to f3efcbfc9b)