k3s-io/k3s · critical

failed to verify directory %s

Error message

failed to verify directory %s

What it means

dataverify.Verify runs checksum (VerifySums over .sha256sums) and symlink (VerifyLinks over .links) validation over a directory. It is called from cmd/k3s/main.go:306 on the freshly untarred embedded data bundle (<data-dir>/data/<version>-tmp/bin) before a new k3s data dir is activated - it is the integrity gate for the packed agent/controller binaries. This aggregate error fires when either check failed; the specific failure is logged just above via 'Unable to verify sums/links'.

Source

Thrown at pkg/dataverify/dataverify.go:28

	"path/filepath"
	"strings"

	"github.com/sirupsen/logrus"
)

// Verify will check the sha256sums and links from the files in a given directory
func Verify(dir string) error {
	failed := false
	if err := VerifySums(dir, ".sha256sums"); err != nil {
		logrus.Errorf("Unable to verify sums: %s", err)
		failed = true
	}
	if err := VerifyLinks(dir, ".links"); err != nil {
		logrus.Errorf("Unable to verify links: %s", err)
		failed = true
	}
	if failed {
		return fmt.Errorf("failed to verify directory %s", dir)
	}
	return nil
}

// VerifySums will take a file which contains a list of hash sums for files and verify they match
func VerifySums(root, sumListFile string) error {
	sums, err := fileMapFields(filepath.Join(root, sumListFile), 1, 0)
	if err != nil {
		return err
	}
	if len(sums) == 0 {
		return fmt.Errorf("no entries found in %s", sumListFile)
	}
	numFailed := 0
	for sumFile, sumExpected := range sums {
		file := filepath.Join(root, sumFile)
		sumActual, _ := sha256Sum(file)
		if sumExpected != sumActual {

View on GitHub (pinned to 6ba341e396)

Solutions

1. Read the log lines immediately above the error ('Unable to verify sums: ...' / 'Unable to verify links: ...') to see which sub-check failed.
2. Reinstall k3s from an official release (verify the binary/archives checksum yourself), then delete the leftover <data-dir>/data/*-tmp directory so extraction reruns cleanly.
3. Check filesystem health: dmesg for I/O errors, smartctl, and df for a full disk; fix the underlying storage issue before retrying.

// Run the same verification k3s runs, after staging the binary / before restart:
import "github.com/k3s-io/k3s/pkg/dataverify"

if err := dataverify.Verify(filepath.Join(dataDir, "data", version, "bin")); err != nil {
    log.Fatalf("data dir integrity check failed: %v - refuse to start on damaged data", err)
}

When it happens

Trigger: Any hash mismatch, symlink mismatch, or unparseable/empty .sha256sums/.links file inside the extracted bin directory during data-dir preparation on startup or upgrade (cmd/k3s/main.go:303-308).

Common situations: Truncated or corrupted binary download/install; bit rot or a failing disk corrupting extracted files; antivirus quarantine emptying files; a tampered or hand-modified build; untar interrupted by disk-full.

Related errors

• no entries found in %s
• failed %d hash verifications
• failed %d link verifications
• fields for file %s (%d) smaller than required index (key: %d
• error extracting zstd-compressed body: %v

AI-assisted analysis of k3s-io/k3s@6ba341e396 (2026-08-15). Data as JSON: /api/errors/690134578ede33ea. Report an issue: GitHub.