iOfficeAI/OfficeCLI · error · Error

Checksum mismatch for ${asset} (expected ${expected}, got ${

Error message

Checksum mismatch for ${asset} (expected ${expected}, got ${actual})

What it means

Thrown by verifyChecksum() when the SHA-256 of the downloaded platform binary does not equal the value listed in SHA256SUMS for that asset. The installer pins a release tag and verifies integrity; a mismatch means the bytes on disk differ from the signed checksum list, so it refuses to install the corrupted/wrong file.

Source

Thrown at npm/lib/install-binary.js:207

  }
  // SHA256SUMS rows are "<hex>  <name>" (sha256sum text mode). Match the
  // filename column EXACTLY (a leading '*' marks binary mode), never a
  // substring — same rule as install.sh / the C# self-updater.
  let expected = null;
  for (const line of sums.split('\n')) {
    const parts = line.trim().split(/\s+/);
    if (parts.length >= 2) {
      const name = parts[1].replace(/^\*/, '');
      if (name === asset) { expected = parts[0]; break; }
    }
  }
  if (!expected) {
    log('  ' + asset + ' not listed in SHA256SUMS, skipping verification.');
    return;
  }
  const actual = crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
  if (actual.toLowerCase() !== expected.toLowerCase()) {
    throw new Error('Checksum mismatch for ' + asset + ' (expected ' + expected + ', got ' + actual + ')');
  }
  log('  checksum verified.');
}

// Download the platform binary into bin/ if it is not already present.
// Idempotent: a non-empty binary is treated as already installed (the package
// version pins the release, so existence is sufficient).
async function ensureBinary() {
  const dest = binaryPath();
  if (fs.existsSync(dest) && fs.statSync(dest).size > 0) {
    return dest;
  }
  fs.mkdirSync(BIN_DIR, { recursive: true });
  const asset = detectAsset();
  let lastErr = null;
  for (const url of assetUrls(asset)) {
    try {
      log('Downloading ' + asset + ' (' + TAG + ') from ' + url + ' ...');

View on GitHub (pinned to 1ced45e900)

Solutions

Delete the partial binary (rm -rf node_modules/@officecli/officecli/vendor) and the npm cache for the package, then reinstall.
Clear npm/global caches: `npm cache clean --force` and re-run install so the mirror is re-fetched.
Inspect the failing URL with `curl -fsSL <assetUrl> | sha256sum` to confirm whether the mirror or GitHub releases serves the bad bytes, then use whichever matches SHA256SUMS.
If a proxy/TLS inspector is involved, bypass it for d.officecli.ai and github.com, or download manually from GitHub releases and verify the checksum yourself before placing the binary.

Example fix

// before: postinstall aborts with Checksum mismatch
// after: purge the poisoned binary and re-fetch
rm -rf node_modules/@officecli/officecli/vendor
npm cache clean --force
npm install

Defensive patterns

Strategy: retry

Try / catch

// Re-run install in a fresh cache; a checksum mismatch is usually a bad cached blob
try {
  require('@officecli/officecli'); // triggers postinstall ensureBinary
} catch (e) {
  if (/Checksum mismatch/.test(e.message)) {
    require('fs').rmSync(require('path').join(__dirname, 'node_modules/@officecli/officecli/vendor'), { recursive:true, force:true });
    require('child_process').execSync('npm install', { stdio:'inherit' });
  } else throw e;
}

Prevention

Keep npm cache clean in CI (npm cache clean --force on suspected corruption).
Bypass byte-mutating proxies/TLS inspectors for the download hosts.
Pin the package version so TAG/SHA256SUMS stay stable.

When it happens

Trigger: A truncated or corrupted download (network drop, proxy rewriting bytes); the mirror serving a stale/erroneous asset under the right name; disk write interrupted mid-stream; a CDN edge caching a bad object; the wrong TAG/VERSION string yielding an asset whose SHA256SUMS row doesn't match.

Common situations: Flaky corporate proxy or transparent TLS inspector corrupting the stream; npm cache serving a partial file; the binary deleted/recreated between the download and the readFileSync; CI behind a caching layer with a poisoned blob.

Related errors

AI-assisted analysis of iOfficeAI/OfficeCLI@1ced45e900 (2026-08-13). Data as JSON: /api/errors/58f6d259b8568c10. Report an issue: GitHub.