kubernetes/kops · error

downloaded from %q but hash did not match expected %q

Error message

downloaded from %q but hash did not match expected %q

What it means

Thrown at the end of downloadURLToWriter when the download completed but the computed hash of the received bytes does not equal the expected hash passed by the caller. This is content integrity validation: the file at the URL changed, the transfer was corrupted/truncated, or the pinned hash in the spec is outdated.

Source

Thrown at upup/pkg/fi/http.go:135

		}
	default:
		reader, err := OpenURL(desturl)
		if err != nil {
			return nil, err
		}
		defer reader.Close()

		if _, err := io.Copy(writer, reader); err != nil {
			return nil, fmt.Errorf("error downloading HTTP content from %q: %v", desturl, err)
		}
	}

	actual := &hashing.Hash{
		Algorithm: algorithm,
		HashValue: hasher.Sum(nil),
	}
	if hash != nil && !actual.Equal(hash) {
		return nil, fmt.Errorf("downloaded from %q but hash did not match expected %q", desturl, hash)
	}
	return actual, nil
}

// OpenURL opens a hardened HTTP GET stream for url.
func OpenURL(url string) (io.ReadCloser, error) {
	httpClient := newDownloadHTTPClient()

	ctx, cancel := context.WithTimeout(context.Background(), downloadTimeout)
	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
	if err != nil {
		cancel()
		return nil, fmt.Errorf("cannot create request: %v", err)
	}

	response, err := httpClient.Do(req)
	if err != nil {
		cancel()

View on GitHub (pinned to 4c8573c808)

Solutions

1. If the upstream artifact legitimately changed, update the pinned hash in the kOps spec/asset definition
2. Otherwise suspect a compromised or misconfigured mirror; re-download from the official source
3. Clear any cached partial download and retry on a stable connection
4. Verify by computing the hash of the URL content manually and comparing to the spec

When it happens

Trigger: Thrown at upup/pkg/fi/http.go:135 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/d4cf7f9ebbe820be. Report an issue: GitHub.