What causes "Failed to hash: %s" in hashicorp/packer?

Retry the download/install — transient network errors usually resolve.

Failed to hash: %s

Error message

Failed to hash: %s

What it means

Checksummer.Sum reads the whole stream with io.Copy into the configured hash and returns this error when the read fails mid-stream. It wraps the reader's I/O error, meaning hashing aborted because the input could not be fully read.

Source

Thrown at packer/plugin-getter/checksum.go:99

// ChecksumFile compares the expected checksum to the checksum of the file in
// filePath using the hash function.
func (c *Checksummer) ChecksumFile(expected []byte, filePath string) error {
	f, err := os.Open(filePath)
	if err != nil {
		return fmt.Errorf("Checksum: failed to open file for checksum: %s", err)
	}
	defer f.Close()
	err = c.Checksum(expected, f)
	if cerr, ok := err.(*ChecksumError); ok {
		cerr.File = filePath
	}
	return err
}

func (c *Checksummer) Sum(f io.Reader) ([]byte, error) {
	c.Hash.Reset()
	if _, err := io.Copy(c.Hash, f); err != nil {
		return nil, fmt.Errorf("Failed to hash: %s", err)
	}
	return c.Hash.Sum(nil), nil
}

func (c *Checksummer) Checksum(expected []byte, f io.Reader) error {
	actual, err := c.Sum(f)
	if err != nil {
		return err
	}

	if !bytes.Equal(actual, expected) {
		return &ChecksumError{
			Hash:     c.Hash,
			Actual:   actual,
			Expected: expected,
		}
	}

View on GitHub (pinned to eb36e3c3e4)

Solutions

Retry the download/install — transient network errors usually resolve.
Re-download the file and verify checksum again; the local copy may be truncated.
Check disk health (dmesg/smartctl) if local file reads fail repeatedly.
Avoid piping from short-lived processes; hash from a fully written file.

Defensive patterns

Strategy: retry

Validate before calling

if f, ok := r.(*os.File); ok {
    if fi, err := f.Stat(); err == nil && !fi.Mode().IsRegular() { /* warn: non-regular file may fail mid-read */ }
}

Try / catch

for attempt := 0; attempt < 3; attempt++ {
    sum, err := cs.Sum(openStream())
    if err == nil { break }
    time.Sleep(backoff(attempt))
}

Prevention

Retry transient hash/read failures with backoff, especially over HTTP streams.
Prefer hashing a fully-written local file over a live network stream.
Monitor disk health if local reads repeatedly fail.

When it happens

Trigger: Called by Checksum (during plugin verification) or generateMockChecksumFile when the io.Reader (file, HTTP body) returns a read error: network drop mid-download of a checksummed stream, file descriptor closed, or an unreadable file region (I/O error on disk).

Common situations: Unstable network while streaming plugin downloads; a truncated file on a failing disk; piping from a process that exited early; reading from a network mount that dropped.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/dfb53651dbf4dbf7. Report an issue: GitHub.