facebook/flow · critical · Error

Hash of ${flowBinPath} does not match hash from SHASUM256.tx

Error message

Hash of ${flowBinPath} does not match hash from SHASUM256.txt:
Hash of flow binary: ${flowBinHash}
Hash from SHASUM256.txt: ${shasum}

What it means

The final verification step streams the flow binary through sha256 and compares the digest against the SHASUM256.txt entry. A mismatch throws with both hashes. The outer getVerifiedFlowBinPath catches it, logs it, and shows a QuickPick asking whether to proceed — a corrupted or tampered binary is never used silently.

Source

Thrown at packages/flow-for-vscode/src/utils/getVerifiedFlowBinPath.ts:131

    // successfully verified SHASUM256.txt, now we can use it to verify the flow binary
    const { flowBinDirName, flowBinName } =
      await getFlowBinRelativePath(flowBinModulePath);
    const flowBinPath = path.join(
      flowBinModulePath,
      flowBinDirName,
      flowBinName,
    );
    const hash = createHash('sha256');
    const flowBinReadStream = createReadStream(flowBinPath);
    const flowBinHashPromise = new Promise((resolve, reject) => {
      flowBinReadStream.on('end', () => resolve(hash.digest('hex')));
      flowBinReadStream.on('error', reject);
    });
    flowBinReadStream.pipe(hash);
    const flowBinHash = await flowBinHashPromise;
    const shasum = getShasum(shasums.toString(), flowBinDirName, flowBinName);
    if (flowBinHash !== shasum) {
      throw new Error(
        `Hash of ${flowBinPath} does not match hash from SHASUM256.txt:\n` +
          `Hash of flow binary: ${flowBinHash}\n` +
          `Hash from SHASUM256.txt: ${shasum}`,
      );
    }
    return flowBinPath;
  } catch (err: any) {
    logger.error(
      `Error when verifying flow-bin in ${flowBinModulePath}:\n${err.message}`,
    );
    // failed to verify SHASUM256.txt; ask the user whether to proceed anyway
    const quickPickOptions = {
      title: `Unable to verify the integrity of ${flowBinModulePath}. Proceed anyway?`,
    };
    const quickPickItems = [
      {
        label: `Don't try to use ${flowBinModulePath}`,
        proceedAnyway: false,

View on GitHub (pinned to d1341dac89)

Solutions

1. Stop at the prompt and reinstall flow-bin: `npm ci`, or remove node_modules/flow-bin and reinstall
2. If you intentionally patch the binary (codesign/patchelf), accept the prompt knowingly, or bypass verification by setting pathToFlow to an externally managed binary
3. Compare the two hashes in the message; report persistent mismatches to the flow repo and never blindly click 'proceed' on shared machines

import {createHash} from 'crypto';
import {createReadStream} from 'fs';

async function fileMatchesSha256(
  filePath: string,
  expected: string,
): Promise<boolean> {
  return new Promise((resolve) => {
    const hash = createHash('sha256');
    const stream = createReadStream(filePath);
    stream.on('end', () => resolve(hash.digest('hex') === expected));
    stream.on('error', () => resolve(false));
    stream.pipe(hash);
  });
}

// getVerifiedFlowBinPath already catches this and asks the user via
// QuickPick; if you call it yourself, mirror that policy — never proceed
// silently:
try {
  const p = await getVerifiedFlowBinPath(flowBinModulePath, logger);
} catch (err) {
  if (/does not match hash from SHASUM256.txt/.test(err.message)) {
    // stop, notify security/owner, reinstall flow-bin
  } else throw err;
}

When it happens

Trigger: The binary on disk does not match its published checksum: truncated or corrupted download, post-install patching (ad-hoc codesign on macOS, patchelf/ELF rewriting), or genuine tampering.

Common situations: Flaky network corrupting the npm download; macOS gatekeeper/codesign modifications; packagers (nix, patchelf) rewriting binaries; supply-chain tampering — the case this guard exists for.

Related errors

• Failed to verify SHASUM256.txt against public key
• Failed to find SHASUM256.txt line containing ${flowBinRelati
• Pkg flow-bin not found in ${dirsToCheck.join(', ')}
• Failed to determine correct binary for platform ${process.pl
• Failed to find anything starting with ${dirPrefix} in ${flow

AI-assisted analysis of facebook/flow@d1341dac89 (2026-08-17). Data as JSON: /api/errors/6fcb59ec4a7bf163. Report an issue: GitHub.