janhq/jan · critical · Error

Checksum mismatch for ${name}; the download was corrupt or t

Error message

Checksum mismatch for ${name}; the download was corrupt or tampered with

What it means

Thrown by verifyBackendChecksums after a SHA-512 integrity check fails for a downloaded backend binary. The downloaded file is deleted and the error propagates, halting the download flow. The check uses verifyFileSha512 against a checksums map keyed by filename, and only archives with a matching checksum entry are verified.

Source

Thrown at extensions/llamacpp-extension/src/backend.ts:195

    logger.warn(
      `No usable checksums published for ${version}; skipping verification`
    )
    return
  }

  for (const savePath of savePaths) {
    const name = savePath.split(/[\\/]/).pop() ?? ''
    const expected = checksums[name]
    if (!expected) {
      logger.warn(`No checksum entry for ${name}; skipping verification`)
      continue
    }
    if (await verifyFileSha512(savePath, expected)) {
      logger.info(`Checksum verified for ${name}`)
      continue
    }
    await fs.rm(savePath).catch(() => undefined)
    throw new Error(
      `Checksum mismatch for ${name}; the download was corrupt or tampered with`
    )
  }
}

export async function downloadBackend(
  backend: string,
  version: string,
  source: 'github' | 'cdn' = 'github'
): Promise<void> {
  const janDataFolderPath = await getJanDataFolderPath()
  const sysInfo = await getSystemInfo()
  const proxyConfig = await getProxyConfig()

  const downloadItems: Array<{
    url: string
    save_path: string
    model_id: string

View on GitHub (pinned to fad3f12a14)

Solutions

1. Retry the download — a transient corruption will produce a fresh file that passes verification.
2. Switch the source from 'github' to 'cdn' (or vice versa) to bypass a serving endpoint with a corrupted copy.
3. Manually verify the expected SHA-512 against the release manifest; if the checksums map is stale, update it.
4. Check available disk space — a full disk can truncate the written file.

import crypto from 'node:crypto'
import fs from 'node:fs'

async function verifySha512(filePath: string, expected: string): Promise<boolean> {
  const buf = fs.readFileSync(filePath)
  const hash = crypto.createHash('sha512').update(buf).digest('hex')
  return hash === expected.toLowerCase()
}

// Before trusting a download, verify:
if (!(await verifySha512(savePath, expectedChecksum))) {
  // re-download from alternate source before the extension throws
}

try {
  await downloadBackend(backend, version, source)
} catch (e) {
  if (e instanceof Error && e.message.includes('Checksum mismatch')) {
    // Switch source and retry once
    await downloadBackend(backend, version, source === 'github' ? 'cdn' : 'github')
  } else {
    throw e
  }
}

When it happens

Trigger: A GitHub or CDN download completed but the file's SHA-512 digest does not match the expected value in the checksums map. Causes include network corruption, partial download, proxy/CDN serving a stale or wrong file, or a checksum map that is out of date relative to the published release.

Common situations: Flaky network or interrupted download leaving a truncated file; corporate proxy caching a different file; CDN replication lag after a new release; checksums map not yet updated for a new backend version.

Related errors

• Import of "${FALLBACK_EMBEDDING_MODEL_ID}" did not complete
• Failed to fetch supported backends: ${error instanceof Error
• Backend setup was not successful. Please restart the app in
• Unable to find a suitable port for MLX model
• Failed to fetch repository files

AI-assisted analysis of janhq/jan@fad3f12a14 (2026-08-12). Data as JSON: /api/errors/85fd4175927e470a. Report an issue: GitHub.