{"id":"8f8e92b95703d662","repo":"rust-lang/cargo","slug":"failed-to-verify-the-checksum-of","errorCode":null,"errorMessage":"failed to verify the checksum of `{}`","messagePattern":"failed to verify the checksum of `(.+?)`","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/sources/registry/download.rs","lineNumber":102,"sourceCode":"    })\n}\n\n/// Verifies the integrity of `data` with `checksum` and persists it under the\n/// directory at `cache_path`.\n///\n/// This is primarily called by [`RegistryData::finish_download`](super::RegistryData::finish_download).\npub(super) fn finish_download(\n    cache_path: &Filesystem,\n    gctx: &GlobalContext,\n    encoded_registry_name: InternedString,\n    pkg: PackageId,\n    checksum: &str,\n    data: &[u8],\n) -> CargoResult<File> {\n    // Verify what we just downloaded\n    let actual = Sha256::new().update(data).finish_hex();\n    if actual != checksum {\n        anyhow::bail!(\"failed to verify the checksum of `{}`\", pkg)\n    }\n    gctx.deferred_global_last_use()?.mark_registry_crate_used(\n        global_cache_tracker::RegistryCrate {\n            encoded_registry_name,\n            crate_filename: pkg.tarball_name().into(),\n            size: data.len() as u64,\n        },\n    );\n\n    cache_path.create_dir()?;\n    let path = cache_path.join(&pkg.tarball_name());\n    let path = gctx.assert_package_cache_locked(CacheLockMode::DownloadExclusive, &path);\n    let mut dst = OpenOptions::new()\n        .create(true)\n        .read(true)\n        .write(true)\n        .open(&path)\n        .with_context(|| format!(\"failed to open `{}`\", path.display()))?;","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/rust-lang/cargo/blob/0e07a155371a6ce88ae53a2c00df940280c09a67/src/sources/registry/download.rs#L84-L120","documentation":"After Cargo downloads a `.crate` tarball from a remote registry it recomputes the SHA-256 of the bytes and compares against the `checksum` recorded in the registry index (`download::finish_download`, src/sources/registry/download.rs:100). A mismatch means the downloaded content does not match the registry's recorded hash, so Cargo refuses to persist or unpack it.","triggerScenarios":"Corrupted/truncated download (network drop, flaky proxy, disk write error); a tampered or MITM-altered tarball; a registry mirror serving a stale/mismatched `.crate` for the indexed checksum; concurrent writers corrupting the partial file (though Cargo uses exclusive locks to mitigate).","commonSituations":"Flaky CI network behind a corporate proxy caching a bad copy; a misconfigured registry mirror whose index and crate blobs are out of sync; disk-full / filesystem corruption during write; CDN serving a partially decompressed gzip.","solutions":["Delete the cached tarball under `~/.cargo/registry/cache/` for that registry and re-run `cargo fetch` to re-download.","Clear the whole registry cache (`cargo cache -a` or `rm -rf ~/.cargo/registry/cache/*`) and retry on a stable connection.","If using a mirror, verify the mirror's index and crate storage are in sync; switch `source` replacement back to crates.io to confirm.","Check for disk space / filesystem errors and for any intercepting proxy (set `CARGO_HTTP_CHECK_REVOKE=false` or adjust `http.proxy`) if the transport is being altered."],"exampleFix":"# before: repeated checksum failures from a bad cached blob\ncargo build\n\n# after: evict the bad download and refetch\nrm -rf ~/.cargo/registry/cache/index.crates.io-*/<pkg>-<ver>.crate\ncargo fetch","handlingStrategy":"retry","validationCode":"# Before relying on a downloaded crate, evict suspect caches.\n# (shell, run before cargo if checksum errors recur)\nfind ~/.cargo/registry/cache -name '<pkg>-<ver>.crate' -delete","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Retry downloads once after clearing the bad cache entry — transient corruption is common.","Verify mirror index/crate synchronisation; prefer crates.io when debugging.","Monitor disk space and proxy behaviour that could corrupt downloads."],"tags":["cargo","registry","checksum","download","security","network"],"analyzedSha":"0e07a155371a6ce88ae53a2c00df940280c09a67","analyzedAt":"2026-08-06T01:46:58.334Z","schemaVersion":2}