hashicorp/vagrant · error · Vagrant::Errors::ProviderChecksumMismatch

The checksum of the downloaded provider '%{provider}' did no

Error message

The checksum of the downloaded provider '%{provider}' did not match the
expected value. If the problem persists, please install the provider
manually.

Expected: %{expected}
Received: %{actual}

What it means

Vagrant::Errors::ProviderChecksumMismatch is raised by the macOS host capability that auto-installs VirtualBox (plugins/hosts/darwin/cap/provider_install_virtualbox.rb:39). After `Vagrant::Util::Downloader` fetches the installer, Vagrant computes its SHA-256 with FileChecksum and compares it to the SHA256SUM constant pinned in the plugin; a mismatch aborts before the package is ever executed. This is an integrity guard against truncated, corrupted, or replaced downloads.

Source

Thrown at plugins/hosts/darwin/cap/provider_install_virtualbox.rb:39

        def self.provider_install_virtualbox(env)
          path = Dir::Tmpname.create("vagrant-provider-install-virtualbox") {}

          # Prefixed UI for prettiness
          ui = Vagrant::UI::Prefixed.new(env.ui, "")

          # Start by downloading the file using the standard mechanism
          ui.output(I18n.t(
            "vagrant.hosts.darwin.virtualbox_install_download",
            version: VERSION))
          ui.detail(I18n.t(
            "vagrant.hosts.darwin.virtualbox_install_detail"))
          dl = Vagrant::Util::Downloader.new(URL, path, ui: ui)
          dl.download!

          # Validate that the file checksum matches
          actual = FileChecksum.new(path, Digest::SHA2).checksum
          if actual != SHA256SUM
            raise Vagrant::Errors::ProviderChecksumMismatch,
              provider: "virtualbox",
              actual: actual,
              expected: SHA256SUM
          end

          # Launch it
          ui.output(I18n.t(
            "vagrant.hosts.darwin.virtualbox_install_install"))
          ui.detail(I18n.t(
            "vagrant.hosts.darwin.virtualbox_install_install_detail"))
          script = File.expand_path("../../scripts/install_virtualbox.sh", __FILE__)
          result = Vagrant::Util::Subprocess.execute("bash", script, path)
          if result.exit_code != 0
            raise Vagrant::Errors::ProviderInstallFailed,
              provider: "virtualbox",
              stdout: result.stdout,
              stderr: result.stderr
          end

View on GitHub (pinned to 35f3160f4a)

Solutions

1. Retry the install (re-run `vagrant up`) on a stable network — transient corruption is the most common cause
2. Install VirtualBox manually from virtualbox.org; when VirtualBox is already present, Vagrant skips auto-install entirely
3. Update Vagrant to the latest release so the pinned SHA256SUM matches the currently published artifact
4. If behind a proxy/AV, verify integrity yourself: `shasum -a 256 <downloaded file>` and compare with the error's Expected value

attempts = 0
begin
  provider_install.call
rescue Vagrant::Errors::ProviderChecksumMismatch => e
  attempts += 1
  warn "download corrupted (expected #{e.data[:expected]}, got #{e.data[:actual]})"
  retry if attempts < 2   # one clean re-download
  raise                   # then fall back to manual install
end

When it happens

Trigger: `vagrant up` on macOS with no VirtualBox installed triggers automatic provider installation; the .dmg/.pkg downloads from the pinned virtualbox.org URL but `FileChecksum.new(path, Digest::SHA2).checksum != SHA256SUM` — a proxy mangling the body, a partial download on disk, or upstream re-publishing a different build at the URL this Vagrant release pinned.

Common situations: Corporate proxy or antivirus altering/stripping the downloaded binary; flaky network truncating a multi-hundred-MB file; disk full so the file is incomplete; a VirtualBox point release shipped under the same URL after the user's Vagrant was built, leaving the pinned checksum stale.

Related errors

• The checksum of the downloaded provider '%{provider}' did no
• Installation of the provider '%{provider}' failed! The stdou
• The checksum of the downloaded box did not match the expecte
• Installation of the provider '%{provider}' failed! The stdou
• No synced folder implementation is available for your synced

AI-assisted analysis of hashicorp/vagrant@35f3160f4a (2026-08-21). Data as JSON: /api/errors/af25a96e2f97c3df. Report an issue: GitHub.