k3s-io/k3s · critical

failed %d hash verifications

Error message

failed %d hash verifications

What it means

After parsing .sha256sums, VerifySums recomputes sha256 for each listed file and counts mismatches (mismatches are also logged per-file as 'Hash for file %s expected to be %s (fail)'). A non-zero count returns this error with the number of failed verifications - the extracted binaries do not match their signed checksums.

Source

Thrown at pkg/dataverify/dataverify.go:54

	if err != nil {
		return err
	}
	if len(sums) == 0 {
		return fmt.Errorf("no entries found in %s", sumListFile)
	}
	numFailed := 0
	for sumFile, sumExpected := range sums {
		file := filepath.Join(root, sumFile)
		sumActual, _ := sha256Sum(file)
		if sumExpected != sumActual {
			logrus.Errorf("Hash for file %s expected to be %s (fail)", sumFile, sumExpected)
			numFailed++
		} else {
			logrus.Debugf("Verified hash %s is correct", sumFile)
		}
	}
	if numFailed != 0 {
		return fmt.Errorf("failed %d hash verifications", numFailed)
	}
	return nil
}

// VerifyLinks will take a file which contains a list of target links for files and verify they match
func VerifyLinks(root, linkListFile string) error {
	links, err := fileMapFields(filepath.Join(root, linkListFile), 0, 1)
	if err != nil {
		return err
	}
	if len(links) == 0 {
		return fmt.Errorf("no entries found in %s", linkListFile)
	}
	numFailed := 0
	for linkFile, linkExpected := range links {
		file := filepath.Join(root, linkFile)
		linkActual, _ := os.Readlink(file)
		if linkExpected != linkActual {

View on GitHub (pinned to 6ba341e396)

Solutions

1. Match the per-file 'Hash for file ... (fail)' log lines to identify the damaged files.
2. Remove <data-dir>/data/<version>-tmp and restart k3s to re-extract from the embedded bundle; if it fails again the binary itself is bad - reinstall from an official release and verify its checksum.
3. Run filesystem and disk diagnostics (fsck, smartctl) - repeated mismatches on different files indicate hardware failure.

// Independently re-verify hashes before starting the node:
cmd := exec.Command("sha256sum", "-c", ".sha256sums")
cmd.Dir = filepath.Join(dataDir, "data", version, "bin")
if out, err := cmd.CombinedOutput(); err != nil {
    log.Fatalf("hash verification failed: %v\n%s", err, out)
}

When it happens

Trigger: One or more files in <data-dir>/data/<version>-tmp/bin have content differing from the sha256 recorded in .sha256sums (pkg/dataverify/dataverify.go:41-54). Note sha256Sum's own error is ignored, so a missing file counts as a mismatch too.

Common situations: Corrupted download/installation media; failing disk flipping bits; someone modified or replaced a binary in the bundle; untar interrupted midway leaving short files.

Related errors

• failed to verify directory %s
• no entries found in %s
• failed %d link verifications
• fields for file %s (%d) smaller than required index (key: %d
• error extracting zstd-compressed body: %v

AI-assisted analysis of k3s-io/k3s@6ba341e396 (2026-08-15). Data as JSON: /api/errors/e9c248d7058ad2c1. Report an issue: GitHub.