{"id":"1ea7ab8f19ba74f7","repo":"rust-lang/cargo","slug":"checksum-for-could-not-be-calculated-but-a-c","errorCode":null,"errorMessage":"checksum for `{}` could not be calculated, but a checksum is listed in the existing lock file\n\nthis could be indicative of a few possible situations:\n\n    * the source `{}` supports checksums,\n      but was replaced with one that doesn't\n    * the lock file is corrupt\n\nunable to verify that `{0}` is the same as when the lockfile was generated\n","messagePattern":"checksum for `(.+?)` could not be calculated, but a checksum is listed in the existing lock file\n\nthis could be indicative of a few possible situations:\n\n    \\* the source `(.+?)` supports checksums,\n      but was replaced with one that doesn't\n    \\* the lock file is corrupt\n\nunable to verify that `(.+?)` is the same as when the lockfile was generated\n","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/resolver/resolve.rs","lineNumber":259,"sourceCode":"\nthis could be indicative of a few possible situations:\n\n    * the source `{}` did not previously support checksums,\n      but was replaced with one that does\n    * newer Cargo implementations know how to checksum this source, but this\n      older implementation does not\n    * the lock file is corrupt\n\",\n                        id,\n                        id.source_id()\n                    )\n\n                // If our checksum hasn't been calculated, then it could mean\n                // that future Cargo figured out how to checksum something or\n                // more realistically we were overridden with a source that does\n                // not have checksums.\n                } else if mine.is_none() {\n                    anyhow::bail!(\n                        \"\\\nchecksum for `{}` could not be calculated, but a checksum is listed in \\\nthe existing lock file\n\nthis could be indicative of a few possible situations:\n\n    * the source `{}` supports checksums,\n      but was replaced with one that doesn't\n    * the lock file is corrupt\n\nunable to verify that `{0}` is the same as when the lockfile was generated\n\",\n                        id,\n                        id.source_id()\n                    )\n\n                // If the checksums aren't equal, and neither is None, then they\n                // must both be Some, in which case the checksum now differs.","sourceCodeStart":241,"sourceCodeEnd":277,"githubUrl":"https://github.com/rust-lang/cargo/blob/0e07a155371a6ce88ae53a2c00df940280c09a67/src/resolver/resolve.rs#L241-L277","documentation":"The mirror of error 148: the previous lockfile listed a checksum for a package, but the current resolution could not compute one (`mine.is_none()`). This means a source that previously provided checksums was replaced with one that doesn't, so Cargo can no longer verify the package is identical to what was locked.","triggerScenarios":"A `[source]` replacement pointing crates.io at a local/path/git mirror that does not emit checksums, while `Cargo.lock` still records the original crates.io checksum. The `else if mine.is_none()` branch fires during `merge_previous`.","commonSituations":"Switching to a vendor directory or git mirror via `.cargo/config.toml` `replace-with`; using a private registry that doesn't implement checksums; Cargo downgrade after an upgrade that computed checksums.","solutions":["Configure the replacement source to provide checksums (most registries/mirrors should).","Remove the `replace-with` source replacement if checksum integrity matters.","Regenerate the lockfile (`cargo generate-lockfile`) so it no longer expects a checksum for the now-unchecksummed source.","Switch to a replacement source (e.g. a proper registry mirror) that supports checksums."],"exampleFix":"# before: mirror without checksums\n[source.crates-io]\nreplace-with = \"local-mirror\"\n[source.local-mirror]\ndirectory = \"./vendor\"  # no checksums\n# after\n[source.crates-io]\nreplace-with = \"registry-mirror\"\n[source.registry-mirror]\nregistry = \"https://mirror.example/index\"","handlingStrategy":"validation","validationCode":"# Verify the replacement source supports checksums before switching:\n# prefer a real registry mirror over a bare directory source.\n# After config change:\ncargo generate-lockfile && cargo build","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use registry mirrors (which provide checksums) rather than directory/git mirrors for replacements.","Regenerate the lockfile after any `replace-with` change.","Document source-replacement choices in repo onboarding."],"tags":["checksum","lockfile","source-replacement","integrity"],"analyzedSha":"0e07a155371a6ce88ae53a2c00df940280c09a67","analyzedAt":"2026-08-06T01:46:58.334Z","schemaVersion":2}