{"id":"ad628ec9cd15ccf3","repo":"rust-lang/cargo","slug":"checksum-for-changed-between-lock-files-this","errorCode":null,"errorMessage":"checksum for `{}` changed between lock files\n\nthis could be indicative of a few possible errors:\n\n    * the lock file is corrupt\n    * a replacement source in use (e.g., a mirror) returned a different checksum\n    * the source itself may be corrupt in one way or another\n\nunable to verify that `{0}` is the same as when the lockfile was generated\n","messagePattern":"checksum for `(.+?)` changed between lock files\n\nthis could be indicative of a few possible errors:\n\n    \\* the lock file is corrupt\n    \\* a replacement source in use \\(e\\.g\\., a mirror\\) returned a different checksum\n    \\* the source itself may be corrupt in one way or another\n\nunable to verify that `(.+?)` is the same as when the lockfile was generated\n","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"critical","filePath":"src/resolver/resolve.rs","lineNumber":280,"sourceCode":"the existing lock file\n\nthis could be indicative of a few possible situations:\n\n    * the source `{}` supports checksums,\n      but was replaced with one that doesn't\n    * the lock file is corrupt\n\nunable to verify that `{0}` is the same as when the lockfile was generated\n\",\n                        id,\n                        id.source_id()\n                    )\n\n                // If the checksums aren't equal, and neither is None, then they\n                // must both be Some, in which case the checksum now differs.\n                // That's quite bad!\n                } else {\n                    anyhow::bail!(\n                        \"\\\nchecksum for `{}` changed between lock files\n\nthis could be indicative of a few possible errors:\n\n    * the lock file is corrupt\n    * a replacement source in use (e.g., a mirror) returned a different checksum\n    * the source itself may be corrupt in one way or another\n\nunable to verify that `{0}` is the same as when the lockfile was generated\n\",\n                        id\n                    );\n                }\n            }\n        }\n\n        // Be sure to just copy over any unknown metadata.","sourceCodeStart":262,"sourceCodeEnd":298,"githubUrl":"https://github.com/rust-lang/cargo/blob/0e07a155371a6ce88ae53a2c00df940280c09a67/src/resolver/resolve.rs#L262-L298","documentation":"Both previous and current checksums are `Some` but differ — the package's checksum changed between the locked value and what the current source reports. This is the most serious checksum case: it means the package bytes the Cargo is about to use are not provably the same as what the lockfile pinned, indicating corruption, a divergent mirror, or source tampering.","triggerScenarios":"A mirror/replacement source returns different content (hence different checksum) than crates.io recorded in `Cargo.lock`; a corrupted registry cache; a yanked-and-republished crate; man-in-the-middle or storage corruption. The final `else` branch in the checksum comparison fires.","commonSituations":"Using a crates.io mirror or proxy that serves slightly different artifacts; corrupted `~/.cargo/registry/cache`; a `[patch]`/`[replace]` overriding a crate with content that doesn't match the locked checksum; disk/filesystem corruption.","solutions":["Clear the local registry cache: `cargo cache -a` or delete `~/.cargo/registry/cache` and `src`, then re-fetch.","Remove or fix the `[source]` replacement / mirror that is serving divergent content.","Regenerate the lockfile (`cargo generate-lockfile`) only after confirming the source is trustworthy.","Compare the actual checksum against crates.io to determine whether the source or the lockfile is the mutated side."],"exampleFix":"# before: mirror serves altered artifact\nrm -rf ~/.cargo/registry/cache ~/.cargo/registry/src\ncargo generate-lockfile\ncargo build","handlingStrategy":"try-catch","validationCode":"# In CI, pin and verify registry checksums before building:\ncargo fetch --locked || { echo 'checksum mismatch — possible mirror/cache corruption'; exit 1; }","typeGuard":null,"tryCatchPattern":"// In a wrapping build script:\nlet out = std::process::Command::new(\"cargo\").args([\"build\",\"--locked\"]).output()?;\nif !out.status.success() {\n    let s = String::from_utf8_lossy(&out.stderr);\n    if s.contains(\"checksum\") && s.contains(\"changed between lock files\") {\n        eprintln!(\"Checksum divergence detected — clear ~/.cargo/registry and verify mirror.\");\n    }\n    return Err(anyhow::anyhow!(\"cargo build failed\"));\n}","preventionTips":["Use `--locked` in CI to fail fast on checksum divergence rather than silently updating.","Prefer the official crates.io index over untrusted mirrors.","Periodically clear `~/.cargo/registry/cache` to avoid stale-corrupt artifacts.","Treat any checksum change as a potential integrity/security event until explained."],"tags":["checksum","lockfile","integrity","mirror","security"],"analyzedSha":"0e07a155371a6ce88ae53a2c00df940280c09a67","analyzedAt":"2026-08-06T01:46:58.334Z","schemaVersion":2}