{"id":"b0739efa5f3bcfcd","repo":"rust-lang/cargo","slug":"checksum-for-was-not-previously-calculated-b","errorCode":null,"errorMessage":"checksum for `{}` was not previously calculated, but a checksum could now be calculated\n\nthis could be indicative of a few possible situations:\n\n    * the source `{}` did not previously support checksums,\n      but was replaced with one that does\n    * newer Cargo implementations know how to checksum this source, but this\n      older implementation does not\n    * the lock file is corrupt\n","messagePattern":"checksum for `(.+?)` was not previously calculated, but a checksum could now be calculated\n\nthis could be indicative of a few possible situations:\n\n    \\* the source `(.+?)` did not previously support checksums,\n      but was replaced with one that does\n    \\* newer Cargo implementations know how to checksum this source, but this\n      older implementation does not\n    \\* the lock file is corrupt\n","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/resolver/resolve.rs","lineNumber":237,"sourceCode":"        // * A replacement source wasn't actually a replacement, some changes\n        //   were made\n        //\n        // In all of these cases, we want to report an error to indicate that\n        // something is awry. Normal execution (esp just using crates.io) should\n        // never run into this.\n        for (id, cksum) in previous.checksums.iter() {\n            if let Some(mine) = self.checksums.get(id) {\n                if mine == cksum {\n                    continue;\n                }\n\n                // If the previous checksum wasn't calculated, the current\n                // checksum is `Some`. This may indicate that a source was\n                // erroneously replaced or was replaced with something that\n                // desires stronger checksum guarantees than can be afforded\n                // elsewhere.\n                if cksum.is_none() {\n                    anyhow::bail!(\n                        \"\\\nchecksum for `{}` was not previously calculated, but a checksum could now \\\nbe calculated\n\nthis could be indicative of a few possible situations:\n\n    * the source `{}` did not previously support checksums,\n      but was replaced with one that does\n    * newer Cargo implementations know how to checksum this source, but this\n      older implementation does not\n    * the lock file is corrupt\n\",\n                        id,\n                        id.source_id()\n                    )\n\n                // If our checksum hasn't been calculated, then it could mean\n                // that future Cargo figured out how to checksum something or","sourceCodeStart":219,"sourceCodeEnd":255,"githubUrl":"https://github.com/rust-lang/cargo/blob/0e07a155371a6ce88ae53a2c00df940280c09a67/src/resolver/resolve.rs#L219-L255","documentation":"During `merge_previous` (reconciling the new resolution with the prior `Cargo.lock` checksums): the old lockfile had no checksum for a package (`cksum.is_none()`) but the current resolution computed one. This asymmetry suggests the source's checksum capability changed between runs — e.g. a non-checksummed source was replaced with one that checksums.","triggerScenarios":"A `[source]` replacement swapped a source that didn't provide checksums (some git/path/directory sources) with one that does, so `previous.checksums[id]` was `None` but `self.checksums[id]` is now `Some`. Also triggered by an older Cargo's lockfile being read by a newer Cargo that learned to checksum that source.","commonSituations":"Switching a dependency from a git source to crates.io (or vice versa via replacement); upgrading Cargo across a version that added checksum support for a source kind; a corrupted/partially-written `Cargo.lock` missing a `checksum` field.","solutions":["Regenerate the lockfile with the current Cargo: `cargo generate-lockfile`.","Remove the `[source]` replacement that changed the checksum behavior, or make it consistent across the team.","Ensure all developers use the same Cargo version to avoid checksum-capability drift.","If the lockfile is corrupt, delete `Cargo.lock` and let Cargo rebuild it."],"exampleFix":"# before: .cargo/config.toml replaces crates.io with a non-checksummed mirror\n[source.crates-io]\nreplace-with = \"vendored-sources\"\n# after: remove the replacement or ensure the mirror provides checksums\ncargo generate-lockfile","handlingStrategy":"validation","validationCode":"# Keep source-replacement config consistent; regenerate lockfile after changes:\n# .cargo/config.toml reviewed into git, then:\ncargo generate-lockfile","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Standardize Cargo version across the team via `rust-toolchain.toml`.","Regenerate `Cargo.lock` whenever you change `[source]` replacements.","Avoid mixing checksummed and non-checksummed sources for the same crate."],"tags":["checksum","lockfile","source-replacement","integrity"],"analyzedSha":"0e07a155371a6ce88ae53a2c00df940280c09a67","analyzedAt":"2026-08-06T01:46:58.334Z","schemaVersion":2}