jamiepine/voicebox · critical · ValueError

{label} integrity check failed: expected {expected_sha[:16]}

Error message

{label} integrity check failed: expected {expected_sha[:16]}..., got {actual[:16]}...

What it means

Raised by the ROCm archive download helper after streaming the archive to disk: the computed SHA-256 of the downloaded temp file does not equal expected_sha parsed from the checksum file. A mismatch means the download is corrupt, truncated, or tampered with, and the helper aborts before extraction to prevent installing a bad backend.

Source

Thrown at backend/services/rocm.py:213

        # Verify integrity
        if expected_sha:
            progress.update_progress(
                PROGRESS_KEY,
                current=progress_offset + downloaded,
                total=total_size,
                filename=f"Verifying {label}...",
                status="downloading",
            )
            sha256 = hashlib.sha256()
            with open(temp_path, "rb") as f:
                while True:
                    data = f.read(1024 * 1024)
                    if not data:
                        break
                    sha256.update(data)
            actual = sha256.hexdigest()
            if actual != expected_sha:
                raise ValueError(
                    f"{label} integrity check failed: expected {expected_sha[:16]}..., got {actual[:16]}..."
                )
            logger.info(f"{label}: integrity verified")

        # Extract (use data filter for path traversal protection on Python 3.12+)
        progress.update_progress(
            PROGRESS_KEY,
            current=progress_offset + downloaded,
            total=total_size,
            filename=f"Extracting {label}...",
            status="downloading",
        )
        with tarfile.open(temp_path, "r:gz") as tar:
            tar.extractall(path=dest_dir, filter="data")

        logger.info(f"{label}: extracted to {dest_dir}")
    finally:
        if temp_path.exists():

View on GitHub (pinned to 51f49dea19)

Solutions

1. Re-run the download on a stable connection; delete any partial temp file in dest_dir first.
2. Verify the .tar.gz and .sha256 assets belong to the same release tag (compare filenames in the GitHub release).
3. If a proxy/CDN is corrupting the stream, bypass it or use a different network.
4. Free disk space on the destination volume.
5. Manually compute sha256sum on the downloaded file and compare to the published checksum to confirm the mismatch.

Example fix

// before: integrity check fails after a truncated download
// after: clean up and re-download
# rm dest_dir/.download-*.tmp
# sha256sum <archive>   # compare to published .sha256
# re-run download_rocm_binary()

import hashlib, urllib.request

def expected_matches_local(archive_path: str, expected_sha: str) -> bool:
    h = hashlib.sha256()
    with open(archive_path, 'rb') as f:
        for chunk in iter(lambda: f.read(1024*1024), b''):
            h.update(chunk)
    return h.hexdigest() == expected_sha

for attempt in range(3):
    try:
        await download_verified_archive(client, url, sha256_url, dest_dir, label)
        break
    except ValueError as e:
        if 'integrity check failed' in str(e) and attempt < 2:
            # clear any partial temp file before retry
            for p in dest_dir.glob('.download-*.tmp'):
                p.unlink(missing_ok=True)
            continue
        raise

When it happens

Trigger: Network corruption truncating the archive mid-stream; a transparent proxy/CDN serving a partial or wrong file; the .sha256 file referenced a different build than the .tar.gz (release mismatch); disk write error producing a partial file; man-in-the-middle modification.

Common situations: Flaky connection dropping the stream; mirror/CDN caching a corrupt asset; release where the .sha256 was updated but the .tar.gz asset was not (or vice versa); disk-full during write; antivirus injecting itself into the stream.

Related errors

• {label}: failed to fetch checksum from {sha256_url}
• {label} integrity check failed: expected {expected_sha[:16]}
• ROCm backend download already in progress
• {label}: failed to fetch checksum from {sha256_url}
• HTTP error! status: ${response.status}

AI-assisted analysis of jamiepine/voicebox@51f49dea19 (2026-08-12). Data as JSON: /api/errors/b136ac850969b75a. Report an issue: GitHub.