{"id":"6d581ac18affd81b","repo":"rust-lang/cargo","slug":"the-listed-checksum-of-has-changed-expected","errorCode":null,"errorMessage":"the listed checksum of `{}` has changed:\nexpected: {}\nactual:   {}\n\ndirectory sources are not intended to be edited, if modifications are required then it is recommended that `[patch]` is used with a forked copy of the source","messagePattern":"the listed checksum of `(.+?)` has changed:\nexpected: (.+?)\nactual:   (.+?)\n\ndirectory sources are not intended to be edited, if modifications are required then it is recommended that `\\[patch\\]` is used with a forked copy of the source","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/sources/directory.rs","lineNumber":246,"sourceCode":"\n    fn fingerprint(&self, pkg: &Package) -> CargoResult<String> {\n        Ok(pkg.package_id().version().to_string())\n    }\n\n    fn verify(&self, id: PackageId) -> CargoResult<()> {\n        let packages = self.packages.borrow_mut();\n        let Some((pkg, cksum)) = packages.get(&id) else {\n            anyhow::bail!(\"failed to find entry for `{}` in directory source\", id);\n        };\n\n        for (file, cksum) in cksum.files.iter() {\n            let file = pkg.root().join(file);\n            let actual = Sha256::new()\n                .update_path(&file)\n                .with_context(|| format!(\"failed to calculate checksum of: {}\", file.display()))?\n                .finish_hex();\n            if &*actual != cksum {\n                anyhow::bail!(\n                    \"the listed checksum of `{}` has changed:\\n\\\n                     expected: {}\\n\\\n                     actual:   {}\\n\\\n                     \\n\\\n                     directory sources are not intended to be edited, if \\\n                     modifications are required then it is recommended \\\n                     that `[patch]` is used with a forked copy of the \\\n                     source\\\n                     \",\n                    file.display(),\n                    cksum,\n                    actual\n                );\n            }\n        }\n\n        Ok(())\n    }","sourceCodeStart":228,"sourceCodeEnd":264,"githubUrl":"https://github.com/rust-lang/cargo/blob/0e07a155371a6ce88ae53a2c00df940280c09a67/src/sources/directory.rs#L228-L264","documentation":"During directory source `verify`: the SHA-256 computed from a file on disk doesn't match the checksum recorded in that package's `.cargo-checksum.json`. Directory (vendored) sources are immutable by design — Cargo verifies file integrity before use. A mismatch means a file was edited, corrupted, or replaced, breaking the integrity guarantee.","triggerScenarios":"Any modification (even whitespace) to a file inside a vendored crate directory after `cargo vendor` ran; a file deleted and recreated with different content; filesystem/git line-ending or encoding transformations; partial/corrupted vendor extraction.","commonSituations":"Editing a vendored crate to apply a quick patch instead of using `[patch]`; git `autocrlf` converting line endings in vendored files; a CI cache serving a stale/modified vendor dir; manual file moves that altered content.","solutions":["Re-run `cargo vendor <dir>` to restore pristine checksums.","If you genuinely need to modify the source, use `[patch]` pointing at a forked copy rather than editing the vendor directory in place.","Disable git line-ending conversion for the vendor path (`git config core.autocrlf false`) or add a `.gitattributes` with `binary`."],"exampleFix":"# before: edited vendored crate source file\n# after\n[patch.crates-io]\nfoo = { path = \"../my-foo-fork\" }","handlingStrategy":"validation","validationCode":"# Detect modified vendored files before building:\nfind vendor -type f ! -name '.cargo-checksum.json' -exec sha256sum {} + \\\n  | sort  # compare against recorded checksums; any diff = integrity failure\n# Or simply re-vendor:\ncargo vendor vendor","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never edit vendored sources directly — use `[patch]` with a fork.","Disable git line-ending conversion for vendor paths (`core.autocrlf false`, `.gitattributes` binary).","Regenerate the vendor dir in CI from a clean checkout rather than caching mutable copies."],"tags":["directory-source","vendor","checksum","integrity"],"analyzedSha":"0e07a155371a6ce88ae53a2c00df940280c09a67","analyzedAt":"2026-08-06T01:46:58.334Z","schemaVersion":2}