coreybutler/nvm-windows · error

error: failed to download checksum: %v

Error message

error: failed to download checksum: %v

What it means

After downloading the update zip, nvm-windows fetches its sibling checksum file (SourceURL + ".checksum.txt") to validate the download. This error means that second HTTP GET failed. It is returned directly (unlike error 40), aborting the upgrade before extraction. Causes range from transport failures to the checksum file simply not being published next to the asset.

Source

Thrown at src/upgrade/upgrade.go:399

	}
	defer os.RemoveAll(tmp)

	// Download the new app
	source := update.SourceURL
	// source := fmt.Sprintf(update.SourceURL, update.Version)
	// source := fmt.Sprintf(update.SourceURL, "1.1.11") // testing
	body, err := get(source)
	if err != nil {
		status <- Status{Err: fmt.Errorf("error: failed to download new version: %v\n", err)}
	}

	os.WriteFile(filepath.Join(tmp, "assets.zip"), body, os.ModePerm)
	os.Mkdir(filepath.Join(tmp, "assets"), os.ModePerm)

	source = source + ".checksum.txt"
	body, err = get(source)
	if err != nil {
		return fmt.Errorf("error: failed to download checksum: %v\n", err)
	}

	os.WriteFile(filepath.Join(tmp, "assets.zip.checksum.txt"), body, os.ModePerm)

	filePath := filepath.Join(tmp, "assets.zip")                  // path to the file you want to validate
	checksumFile := filepath.Join(tmp, "assets.zip.checksum.txt") // path to the checksum file

	// Step 1: Compute the MD5 checksum of the file
	status <- Status{Text: "verifying checksum..."}
	computedChecksum, err := computeMD5Checksum(filePath)
	if err != nil {
		status <- Status{Err: fmt.Errorf("Error computing checksum: %v", err)}
	}

	// Step 2: Read the checksum from the .checksum.txt file
	storedChecksum, err := readChecksumFromFile(checksumFile)
	if err != nil {
		status <- Status{Err: err}

View on GitHub (pinned to 5b18223ca1)

Solutions

1. curl -I <SourceURL>.checksum.txt to confirm the checksum sidecar exists and returns 200.
2. If a mirror is configured (NVM_NVM_HOME mirror settings), switch back to the official GitHub release URL or pick a mirror that also hosts checksums.
3. Retry the upgrade — a transient failure of the second request aborts safely before any files are replaced.
4. If checksums are genuinely unavailable upstream, wait for/package a corrected release rather than skipping validation.

// Check the checksum sidecar exists before running the upgrade
resp, err := http.Head(update.SourceURL + ".checksum.txt")
if err != nil || resp.StatusCode != http.StatusOK {
    fmt.Println("checksum file missing at", update.SourceURL+".checksum.txt", "— do not upgrade")
}

Catch the returned error at the upgrade entrypoint; abort cleanly (installation is untouched at this stage) and surface the URL so the user can verify manually.

When it happens

Trigger: SourceURL resolves but <SourceURL>.checksum.txt does not (404) — maintainer published the zip without the checksum sidecar; proxy/TLS interception that allowed the first request but blocked the .txt; connection dropped between the two sequential GETs; mirror that mirrors zips but not checksum files.

Common situations: Using a third-party mirror of nvm-windows releases that omits checksum files; upgrading while network is flaky; GitHub raw content blocked by policy while release assets are allowed.

Related errors

• error: failed to download new version: %v
• cannot validate update file (checksum mismatch)
• error: failed to download asset: %v
• failed to download v%v arm 64-bit executable
• Failed to extract npm: %v

AI-assisted analysis of coreybutler/nvm-windows@5b18223ca1 (2026-08-15). Data as JSON: /api/errors/2b08165424b0a694. Report an issue: GitHub.