cypress-io/cypress · error · Error

Corrupted download Expected downloaded file to have checksu

Error message

Corrupted download

Expected downloaded file to have checksum: ${expectedChecksum}
Computed checksum: ${checksum}

What it means

Raised by verifyDownloadedFile() when the CDN response carried only an expected checksum (x-amz-meta-checksum) and the computed SHA of the downloaded file does not match it. Size was not provided by the server in this code path, so checksum is the sole integrity gate. A mismatch means the downloaded bytes differ from the released artifact.

Source

Thrown at cli/lib/tasks/download.ts:167

    debug('only checking expected file checksum %d', expectedChecksum)

    const checksum: string = await util.getFileChecksum(filename)

    if (checksum === expectedChecksum) {
      debug('downloaded file has the expected checksum ✅')

      return
    }

    debug('raising error: file checksum mismatch')
    const text = stripIndent`
      Corrupted download

      Expected downloaded file to have checksum: ${expectedChecksum}
      Computed checksum: ${checksum}
    `

    throw new Error(text)
  }

  if (expectedSize) {
    // maybe we don't have a checksum, but at least CDN returns content length
    // which we can check against the file size
    debug('only checking expected file size %d', expectedSize)

    const filesize: number = await util.getFileSize(filename)

    if (filesize === expectedSize) {
      debug('downloaded file has the expected size ✅')

      return
    }

    debug('raising error: file size mismatch')
    const text = stripIndent`
        Corrupted download

View on GitHub (pinned to 0d85fdc912)

Solutions

1. Re-run `cypress install` after clearing the download destination and ~/.cache/Cypress.
2. If using CYPRESS_DOWNLOAD_MIRROR, confirm the mirror serves the official, unmodified zip with intact metadata; switch back to the default or a trusted mirror.
3. Disable/inspect interfering proxies, TLS-inspecting firewalls, or antivirus that may alter the byte stream.
4. Provide CYPRESS_INSTALL_BINARY pointing to a verified local copy of cypress.zip.

Example fix

# before: checksum mismatch on install
# after:
unset CYPRESS_DOWNLOAD_MIRROR
rm -rf ~/.cache/Cypress
cypress install

try {
  await cypress.install()
} catch (e) {
  if (e instanceof Error && /Corrupted download/.test(e.message)) {
    await fs.remove(process.env.CYPRESS_CACHE_FOLDER || `${os.homedir()}/.cache/Cypress`)
    await cypress.install()
  }
}

When it happens

Trigger: `cypress install` where the server omits a size header but provides x-amz-meta-checksum, and the file written to disk hashes to a different value. Common with custom mirrors or proxies that strip content-length/x-amz-meta-size but keep the checksum header.

Common situations: A custom CYPRESS_DOWNLOAD_MIRROR that does not preserve all S3 metadata; a proxy rewriting the body; disk corruption; partial download that happened to hit the same byte count coincidence is not possible here since size is unchecked.

Related errors

• Corrupted download Expected downloaded file to have checksu
• Corrupted download Expected downloaded file to have size: $
• Refusing to extract entry outside of destination: ${entry.fi
• Refusing to extract symlink with target larger than ${MAX_SY
• Refusing to extract symlink pointing outside of destination:

AI-assisted analysis of cypress-io/cypress@0d85fdc912 (2026-08-12). Data as JSON: /api/errors/696eeaa507dad1c9. Report an issue: GitHub.