What causes "Package hash '{0}' did not match expected hash '{1}'." in chocolatey/choco?

Clear the local NuGet/Chocolatey cache and re-download the package

chocolatey/choco · error · InvalidDataException

Package hash '{0}' did not match expected hash '{1}'.

Error message

Package hash '{0}' did not match expected hash '{1}'.

What it means

ValidatePackageHash compares the downloaded package's hash (from metadataFileContents.ContentHash) against the source-advertised hash. When the converted hashes do not match case-insensitively, it throws InvalidDataException with the actual and expected hash values. A missing SHA512 from the source only logs a warning and does not throw.

Source

Thrown at src/chocolatey/infrastructure.app/services/NugetService.cs:3290

                    using (var metadataFileStream = downloadResult.PackageReader.GetStream(PackagingCoreConstants.NupkgMetadataFileExtension))
                    {
                        var metadataFileContents = NupkgMetadataFileFormat.Read(metadataFileStream,
                                                                                _nugetLogger,
                                                                                PackagingCoreConstants.NupkgMetadataFileExtension);

                        var metadataFileHashInfo = HashConverter.ConvertHashToHex(metadataFileContents.ContentHash);

                        if (hashInfo.ConvertedHash.Equals(metadataFileHashInfo.ConvertedHash, StringComparison.OrdinalIgnoreCase))
                        {
                            this.Log().Debug("Package hash matches expected hash.");
                        }
                        else
                        {
                            var errorMessage = "Package hash '{0}' did not match expected hash '{1}'."
                                    .FormatWith(metadataFileContents.ContentHash,
                                                hashInfo.ConvertedHash);

                            throw new InvalidDataException(errorMessage);
                        }
                    }
                }
                else
                {
                    this.Log().Warn("Source is not providing a SHA512 hash, cannot validate package hash.");
                }
            }
        }

#pragma warning disable IDE0022, IDE1006
        [Obsolete("This overload is deprecated and will be removed in v3.")]
        public void ensure_source_app_installed(ChocolateyConfiguration config, Action<PackageResult, ChocolateyConfiguration> ensureAction)
            => EnsureSourceAppInstalled(config, ensureAction);

        [Obsolete("This overload is deprecated and will be removed in v3.")]
        public virtual int count_run(ChocolateyConfiguration config)
            => Count(config);

View on GitHub (pinned to 0d5abdd10c)

Solutions

Clear the local NuGet/Chocolatey cache and re-download the package
Verify network stability and disable any corrupting proxy
Confirm the source's advertised hash matches the actual nupkg (contact the feed admin)
Re-download the .nupkg and compute its SHA512 manually to compare against the expected value

Example fix

// before
choco install mypkg
// after
choco cache remove
choco install mypkg

Defensive patterns

Strategy: retry

Validate before calling

// Clear the cache before install when hash mismatches are suspected.
if (!config.CacheLocation.IsNullOrWhiteSpace()) choco.ClearCache();
// Optionally pre-download and verify the nupkg SHA512 against the source hash.

Try / catch

int attempts = 0;
retry:
try { choco.Install(config); }
catch (InvalidDataException ex) when (ex.Message.Contains("did not match expected hash") && attempts++ < 2) {
    choco.ClearCache(); goto retry;
}

Prevention

Clear the cache before retrying a hash-mismatch failure
Use a trusted source and HTTPS to avoid in-transit corruption
Disable corrupting proxies and verify network integrity for large downloads

When it happens

Trigger: The computed/recorded hash of the downloaded nupkg differs from the SHA512 advertised by the source; the equality check (hashInfo.ConvertedHash vs metadataFileHashInfo.ConvertedHash, OrdinalIgnoreCase) fails.

Common situations: Network/proxy corruption altering bytes; a partially cached nupkg; a republished package whose hash metadata was not updated; man-in-the-middle tampering with the download.

Related errors

AI-assisted analysis of chocolatey/choco@0d5abdd10c (2026-08-13). Data as JSON: /api/errors/f525a334d9f8e92e. Report an issue: GitHub.