denoland/deno · critical

Checksum mismatch for {}: expected {}, got {}

Error message

Checksum mismatch for {}: expected {}, got {}

What it means

During provenance verification, each file's checksum in the registry's version manifest is compared with the hash of the corresponding file in the tarball Deno prepared. A mismatch means the content JSR recorded differs from what Deno hashed locally — an integrity failure, not a usage error, and a potential supply-chain signal.

Source

Thrown at cli/tools/publish/mod.rs:1487

  if manifest.manifest.len() != package.tarball.files.len() {
    bail!(
      "Mismatch in the number of files in the manifest: expected {}, got {}",
      package.tarball.files.len(),
      manifest.manifest.len()
    );
  }

  for (path, entry) in manifest.manifest {
    // Verify each path with the files in the tarball.
    let file = package
      .tarball
      .files
      .iter()
      .find(|f| f.path_str == path.as_str());

    if let Some(file) = file {
      if file.hash != entry.checksum {
        bail!(
          "Checksum mismatch for {}: expected {}, got {}",
          path,
          entry.checksum,
          file.hash
        );
      }
    } else {
      bail!("File {} not found in the tarball", path);
    }
  }

  for (specifier, expected) in &manifest.exports {
    let actual = package.exports.get(specifier).ok_or_else(|| {
      deno_core::anyhow::anyhow!(
        "Export {} not found in the package",
        specifier
      )
    })?;

View on GitHub (pinned to f7822238ca)

Solutions

1. Retry the release — transient ingest errors are the likeliest cause and completed versions are skipped on re-run.
2. If reproducible, report it at https://github.com/denoland/deno/issues with the package name and version.
3. Emergency releases can skip verification with `--no-provenance` (accepting a weaker attestation).

#!/usr/bin/env bash
out="$(deno publish 2>&1)" || {
  if printf '%s' "$out" | grep -q 'Checksum mismatch'; then
    echo "INTEGRITY: uploaded content hash != registry manifest hash — report upstream, investigate before re-release" >&2
    exit 71
  fi
  printf '%s\n' "$out" >&2; exit 1
}

When it happens

Trigger: `file.hash != entry.checksum` in `verify_version_manifest` — tarball bytes changed between local hashing and server-side ingestion, or the manifest refers to different content (registry bug or tampering).

Common situations: Almost always infrastructure-level; surfaces only in provenance-enabled (GitHub Actions + OIDC) publishes.

Related errors

• Mismatch in the number of files in the manifest: expected {}
• Failed to fetch package manifest from {meta_url}: status {st
• File {} not found in the tarball
• Export {} mismatch: expected {}, got {}
• Automatic provenance is only available in GitHub Actions

AI-assisted analysis of denoland/deno@f7822238ca (2026-08-20). Data as JSON: /api/errors/405de72ad86b1a4a. Report an issue: GitHub.