jdx/mise · error

verified checksum file digest does not match existing…

Error message

verified checksum file digest does not match existing checksum for {filename}

What it means

After verifying a downloaded artifact against a checksum file, mise records the verified digest in the tool-version lock/platform info. This error is thrown when a digest was already recorded for the same file with the same checksum algorithm, but the newly computed digest differs — meaning the release content changed under the same version, or lockfile/platform state disagrees with what upstream now serves.

Solutions

1. Treat this as a supply-chain red flag: verify on the upstream release page that the artifact was legitimately changed
2. If the release was legitimately re-tagged, remove the cached download and the stale checksum entry (delete the version from mise.lock / `mise uninstall <tool>@<ver>` then reinstall)
3. Check for a proxy or mirror serving different content and bypass it
4. File an issue with the aqua registry/upstream if the release was tampered with

Example fix

// before: stale recorded checksum for replaced release
mise uninstall gh@2.40.0
rm -rf ~/.local/share/mise/downloads/aqua/gh/2.40.0
// after: fresh install re-verifies and records the new digest
mise install gh@2.40.0

// before reinstalling, compare the served artifact digest with the recorded one
const digest = crypto.createHash('sha256').update(await fs.readFile(asset)).digest('hex');
if (digest !== lockedChecksum) console.warn('Upstream artifact changed for same version — investigate before reinstalling');

catch (e) {
  if (String(e).includes('does not match existing checksum')) {
    // stop and verify upstream legitimacy; do not auto-retry
    console.error('Release content changed under the same version. Check the upstream release page before reinstalling.');
  }
}

When it happens

Trigger: Reinstalling or re-locking an aqua package when: the platform's checksum was previously recorded (e.g. in mise.lock or a prior install) and the re-downloaded artifact hashes to a different value with the same algorithm; upstream force-pushed/replaced release assets; a mirror served different content.

Common situations: Upstream re-tagged a version with different binaries; a proxy/mirror serves stale or tampered artifacts; switching networks (VPN, corporate proxy) changes what upstream returns; corruption between two installs of the same version.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• verified checksum file digest does not match expected…
• could not resolve the configured checksum for
• expected exactly one Hex OTP build record for
• Invalid checksum
• Invalid checksum

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/5bbf7d05ff051baa. Report an issue: GitHub.

Appendix: source

Thrown at src/backend/aqua.rs:2825

                && !cosign_already_verified
                && checksum_path.exists()
            {
                self.cosign_checksums(ctx, cosign, pkg, v, tv, &checksum_path)
                    .await?;
            }

            if needs_verified_checksum_binding && checksum_path.exists() {
                let checksum_content = file::read_to_string_bom(&checksum_path)?;
                let checksum_str =
                    self.parse_checksum_from_content(&checksum_content, checksum, filename)?;
                let checksum_val = format!("{}:{}", checksum.algorithm(), checksum_str);
                let platform_key = self.get_platform_key();
                let platform_info = tv.lock_platforms.entry(platform_key).or_default();
                if let Some(existing_checksum) = &platform_info.checksum
                    && same_checksum_algorithm(existing_checksum, &checksum_val)
                    && existing_checksum != &checksum_val
                {
                    bail!(
                        "verified checksum file digest does not match existing checksum for {filename}"
                    );
                }
                platform_info.checksum = Some(checksum_val);
            }
        }
        if let Some(pi) = tv.lock_platforms.get_mut(&platform_key)
            && pi.provenance.is_some()
        {
            pi.github_attestations = None;
        }

        // If lockfile recorded verified provenance, verify that the type matches
        // (checked after all verification methods including cosign have had a chance to record)
        if let Some(expected) = expected_provenance {
            let platform_key = self.get_platform_key();
            let got = tv
                .lock_platforms

View on GitHub (pinned to 533346cc37)