jamiepine/voicebox · critical · ValueError

{label} integrity check failed: expected {expected_sha[:16]}

Error message

{label} integrity check failed: expected {expected_sha[:16]}..., got {actual[:16]}...

What it means

After streaming the archive to a temp file, _download_and_extract_archive() SHA-256 hashes it and compares to expected_sha (parsed from the .sha256 file). On mismatch it raises ValueError; the outer finally always deletes the temp file, so a failed archive is never extracted. This catches truncated downloads, on-disk corruption, and tampered/compromised assets.

Source

Thrown at backend/services/cuda.py:236

        # Verify integrity
        if expected_sha:
            progress.update_progress(
                PROGRESS_KEY,
                current=progress_offset + downloaded,
                total=total_size,
                filename=f"Verifying {label}...",
                status="downloading",
            )
            sha256 = hashlib.sha256()
            with open(temp_path, "rb") as f:
                while True:
                    data = f.read(1024 * 1024)
                    if not data:
                        break
                    sha256.update(data)
            actual = sha256.hexdigest()
            if actual != expected_sha:
                raise ValueError(
                    f"{label} integrity check failed: expected {expected_sha[:16]}..., got {actual[:16]}..."
                )
            logger.info(f"{label}: integrity verified")

        # Extract (use data filter for path traversal protection on Python 3.12+)
        progress.update_progress(
            PROGRESS_KEY,
            current=progress_offset + downloaded,
            total=total_size,
            filename=f"Extracting {label}...",
            status="downloading",
        )
        with tarfile.open(temp_path, "r:gz") as tar:
            if sys.version_info >= (3, 12):
                tar.extractall(path=dest_dir, filter="data")
            else:
                tar.extractall(path=dest_dir)

View on GitHub (pinned to 51f49dea19)

Solutions

1. Re-run download_cuda_binary() on a stable link (the finally block deletes the temp; a crashed process usually leaves no partial, but check for stray .download-*.tmp).
2. Manually compare the published .sha256 against the GitHub UI to rule out a mismatched release asset.
3. If it reproduces consistently, the published archive/checksum pair is likely broken — file an issue rather than force-extracting.

Example fix

# before
if actual != expected_sha:
    raise ValueError(f"{label} integrity check failed: ...")

# after — clear partial state and re-raise (do NOT extract)
if actual != expected_sha:
    temp_path.unlink(missing_ok=True)
    raise ValueError(f"{label} integrity check failed: ...")

import hashlib
from pathlib import Path

def local_sha256(path: Path) -> str:
    h = hashlib.sha256()
    with open(path, "rb") as f:
        for chunk in iter(lambda: f.read(1 << 20), b""):
            h.update(chunk)
    return h.hexdigest()
# compare local_sha256(temp) against the published checksum before trusting

for attempt in range(2):
    try:
        await download_cuda_binary(version)
        break
    except ValueError as e:
        if "integrity check failed" in str(e) and attempt == 0:
            await delete_cuda_binary()  # clear bad state, then retry once
            continue
        raise

When it happens

Trigger: Network drop mid-stream truncating the multi-hundred-MB CUDA-libs archive, disk write corruption, a MITM/compromised CDN serving a different asset, or a release where the archive and .sha256 were uploaded from different builds.

Common situations: Unstable connection dropping a large transfer; antivirus/security tool rewriting the stream in flight; mismatched archive/checksum pair published to a release.

Related errors

• {label} integrity check failed: expected {expected_sha[:16]}
• {label}: failed to fetch checksum from {sha256_url}
• releases ${r.status}
• `audio_path` is only available to loopback callers — remote
• Whisper model '{model_size}' is not yet downloaded. Open Voi

AI-assisted analysis of jamiepine/voicebox@51f49dea19 (2026-08-12). Data as JSON: /api/errors/1de8a27502aa56f6. Report an issue: GitHub.