crowdsecurity/crowdsec · error

%w. The index file is invalid, please run 'cscli hub update'

Error message

%w. The index file is invalid, please run 'cscli hub update' and try again

What it means

After writing the embedded content to disk, writeEmbeddedContentTo hashes the bytes (SHA-256) and compares against the expected hash from the index. On mismatch it returns a downloader.HashMismatchError wrapped with advice to refresh the index — the on-disk file was NOT overwritten with bad content only if the hash check precedes commit; here the file is already written but flagged invalid.

Source

Thrown at pkg/cwhub/fetch.go:52

	tee := io.TeeReader(reader, hash)
	if err := os.MkdirAll(dir, 0o755); err != nil {
		return fmt.Errorf("while creating %s: %w", dir, err)
	}

	f, err := os.OpenFile(destPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o600)
	if err != nil {
		return err
	}

	defer f.Close()

	if _, err := io.Copy(f, tee); err != nil {
		return err
	}

	gotHash := hex.EncodeToString(hash.Sum(nil))
	if gotHash != wantHash {
		return fmt.Errorf("%w. The index file is invalid, please run 'cscli hub update' and try again",
			downloader.HashMismatchError{
				Expected: wantHash,
				Got: gotHash,
			})
	}

	return nil
}

// FetchContentTo writes the last version of the item's YAML file to the specified path.
// If the file is embedded in the index file, it will be written directly without downloads.
// Returns whether the file was downloaded (to inform if the security engine needs reloading)
// and the remote url for feedback purposes.
func (i *Item) FetchContentTo(ctx context.Context, contentProvider ContentProvider, destPath string) (bool, string, error) {
	wantHash := i.latestHash()
	if wantHash == "" {
		return false, "", fmt.Errorf("%s: latest hash missing from index. The index file is invalid, please run 'cscli hub update' and try again", i.FQName())
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Run `sudo cscli hub update` to re-download a consistent index, then `sudo cscli hub upgrade-all`
2. Delete the index file and re-run `cscli hub update` if the mismatch persists
3. Verify network path to hub.crowdsec.net (proxy caching stale content)
4. Report to CrowdSec if a fresh index still mismatches

sum := sha256.Sum256([]byte(item.Content))
want, _ := hex.DecodeString(item.latestHash())
if !bytes.Equal(sum[:], want) {
    return fmt.Errorf("embedded content hash mismatch; refresh index first")
}

var hm downloader.HashMismatchError
if errors.As(err, &hm) {
    logger.Errorf("hash mismatch for %s (want %s got %s); run 'cscli hub update'", item.FQName(), hm.Expected, hm.Got)
    return retryAfterIndexRefresh(ctx)
}

When it happens

Trigger: Embedded base64 content in the hub index does not hash to i.latestHash(): stale index, hub-side publishing inconsistency, or base64 decode fallback producing different bytes than expected.

Common situations: Index file from an older `cscli hub update` while the hub published new content, interrupted index download, or a man-in-the-middle/corrupted mirror serving stale content.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• %s: latest hash missing from index. The index file is invali
• no embedded content for %s
• invalid hub index: %w. Run 'sudo cscli hub update' to downlo
• unable to read index file: %w
• failed to parse index: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/ee7d0598f1a53646. Report an issue: GitHub.