hashicorp/packer · error

checksum mismatch for %s: expected %s, got %s

Error message

checksum mismatch for %s: expected %s, got %s

What it means

Raised when the SHA256 of the downloaded Packer zip on disk does not (case-insensitively) match the expected hash from the official SHA256SUMS file. This is a supply-chain safety check: the downloaded artifact is treated as corrupt or tampered and the operation fails (and is retried up to 3 times).

Source

Thrown at provisioner/hcp-sbom/packer_release_fetch.go:265

		}()

		sumsContent, err := downloadChecksumFile(ctx, client, shaSumsURL)
		if err != nil {
			return fmt.Errorf("failed to download release checksums: %w", err)
		}

		expectedSHA, err := expectedZipSHA256FromSums(sumsContent, fileName)
		if err != nil {
			return fmt.Errorf("failed to resolve expected checksum: %w", err)
		}

		actualSHA, err := fileSHA256(candidateZipPath)
		if err != nil {
			return err
		}

		if !strings.EqualFold(expectedSHA, actualSHA) {
			return fmt.Errorf("checksum mismatch for %s: expected %s, got %s", fileName, expectedSHA, actualSHA)
		}

		// Validate the expected binary exists inside the archive.
		binaryName := "packer"
		if goos == "windows" {
			binaryName = "packer.exe"
		}

		zr, err := zip.OpenReader(candidateZipPath)
		if err != nil {
			return fmt.Errorf("failed to open downloaded zip: %w", err)
		}
		defer func() { _ = zr.Close() }()

		foundBinary := false
		for _, f := range zr.File {
			if f.Name == binaryName {
				foundBinary = true

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Re-run the build: retries may fetch a clean copy if the corruption was transient.
2. Clear any HTTP caches/proxies between the build host and releases.hashicorp.com.
3. Verify the zip manually with sha256sum and compare against the SHA256SUMS entry.
4. If mismatches persist, treat as a security signal — verify over a trusted network and report suspected tampering.

sum := sha256.Sum256(zipBytes)
actual := hex.EncodeToString(sum[:])
if !strings.EqualFold(actual, expectedSHA) {
	return fmt.Errorf("download corrupt: expected %s got %s — do NOT use the artifact", expectedSHA, actual)
}

if err := run(); err != nil {
	if strings.Contains(err.Error(), "checksum mismatch") {
		// treat as security-relevant: purge caches/proxies and redownload over a trusted path
	}
}

When it happens

Trigger: strings.EqualFold(expectedSHA, actualSHA) is false after computing actualSHA via fileSHA256(candidateZipPath) and expectedSHA via expectedZipSHA256FromSums(sumsContent, fileName).

Common situations: Truncated/corrupted download over a flaky connection; a middlebox or cache returning a different/older artifact; MITM or tampering attempt (the check is doing its job); comparing against a SHA256SUMS from a different version than the downloaded zip.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• failed to download release checksums: %w
• Checksum: failed to open file for checksum: %s
• Failed to hash: %s
• Error reading checksum file: %s
• failed to checksum binary file: %s

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/8bc163ce34bef3a6. Report an issue: GitHub.