kubernetes/kops · error

different sha for same file %s: %s vs %s

Error message

different sha for same file %s: %s vs %s

What it means

When two *CopyFile tasks share the same name and target file but declare different SHA checksums, Copy cannot know which content is correct and would risk copying tampered or mixed-version files, so it fails with this error. The SHA acts as the content-integrity dedup key for files.

Source

Thrown at pkg/assets/assetcopy/copy.go:78

			copyFileTask := &CopyFile{
				Name:       fileAsset.CanonicalURL.String(),
				TargetFile: fileAsset.DownloadURL.String(),
				SourceFile: fileAsset.CanonicalURL.String(),
				SHA:        fileAsset.SHAValue.Hex(),
				VFSContext: vfsContext,
				Cluster:    cluster,
			}

			if existing, ok := tasks[copyFileTask.Name]; ok {
				e, ok := existing.(*CopyFile)
				if !ok {
					return fmt.Errorf("different types for copy target %s", copyFileTask.Name)
				}
				if e.TargetFile != copyFileTask.TargetFile {
					return fmt.Errorf("different targets for same file %s: %s vs %s", copyFileTask.Name, copyFileTask.TargetFile, e.TargetFile)
				}
				if e.SHA != copyFileTask.SHA {
					return fmt.Errorf("different sha for same file %s: %s vs %s", copyFileTask.Name, copyFileTask.SHA, e.SHA)
				}
			}

			tasks[copyFileTask.Name] = copyFileTask
		}
	}

	ch := make(chan error, 5)
	for i := 0; i < cap(ch); i++ {
		ch <- nil
	}

	gotError := false
	names := make([]string, 0, len(tasks))
	for name := range tasks {
		names = append(names, name)
	}
	sort.Strings(names)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Rebuild the asset list from a single consistent kOps version so all SHA values for a file agree
2. Remove stale duplicate fileAsset overrides that declare an old SHA for the same target
3. Verify the file content and recompute the SHA if you intentionally changed the file, updating all references

Example fix

// before
// fileAssets:
//   - name: nodeup, target: /opt/nodeup, sha: aaa111
//   - name: nodeup, target: /opt/nodeup, sha: bbb222
// after
//   - name: nodeup, target: /opt/nodeup, sha: bbb222  (single consistent entry)

fileSHAs := map[string]string{}
for _, f := range fileAssets {
	key := f.Name + "|" + f.TargetFile
	if prev, ok := fileSHAs[key]; ok && prev != f.SHA {
		return fmt.Errorf("pre-check: file %s has conflicting SHAs %s vs %s", key, prev, f.SHA)
	}
	fileSHAs[key] = f.SHA
}

func fileSHAsConsistent(files []FileAsset) bool {
	seen := map[string]string{}
	for _, f := range files {
		key := f.Name + "|" + f.TargetFile
		if p, ok := seen[key]; ok && p != f.SHA {
			return false
		}
		seen[key] = f.SHA
	}
	return true
}

if err := copy.Run(ctx); err != nil {
	if strings.Contains(err.Error(), "different sha for same file") {
		return fmt.Errorf("asset integrity bug: %w — rebuild assets from one kOps version", err)
	}
	return err
}

When it happens

Trigger: Two FileAssets with identical task name and TargetFile but different SHA fields processed in one Copy call, typically from assets lists built at different kOps versions or from modified file assets.

Common situations: Upgrading a cluster where a nodeup/file asset was rebuilt with different content (new binary hash) while old and new asset definitions coexist; custom fileAssets overriding a builtin asset with different content; partially updated manifest templates.

Related errors

• different types for copy target %s
• different targets for same file %s: %s vs %s
• unable to marshal YAML: %v
• unable to marshal JSON: %v
• unable to find any containerd binaries in assets

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/006143cdf52d80b8. Report an issue: GitHub.