microsoft/aspire · error · InvalidDataException

Aspire skills GitHub release asset

Error message

Aspire skills GitHub release asset '{0}' failed SHA-256 verification.

What it means

When installing a skills bundle from a GitHub release, InstallFromGitHubAsync computes the SHA-256 of the downloaded archive and, if the release metadata supplied an expected hash, compares them. A mismatch throws InvalidDataException naming the asset, guarding against corrupted or tampered downloads.

Solutions

Re-download the asset and retry the install (transient corruption is the most common cause)
Check whether the release was republished; if so, the expected checksum may be stale — use an updated bundle release
Verify the expected SHA-256 published by the release matches the manifest/checksum source, and report the mismatch if the asset was tampered with

Defensive patterns

Strategy: try-catch

Validate before calling

// verify the archive digest before handing it to the installer
using var sha = System.Security.Cryptography.SHA256.Create();
var hash = Convert.ToHexString(sha.ComputeHash(File.ReadAllBytes(archivePath)));
bool matches = string.Equals(hash, expectedSha256, StringComparison.OrdinalIgnoreCase);

Try / catch

try
{
    await installer.InstallFromGitHubAsync(release, ct);
}
catch (InvalidDataException ex) when (ex.Message.Contains("failed SHA-256 verification"))
{
    logger.LogError(ex, "Archive failed SHA-256 verification; re-download or do not trust this release asset.");
    // treat as untrusted input: delete the cached archive
    File.Delete(archivePath);
}

Prevention

Prefer secure, retryable downloads so a corrupted file is re-fetched automatically
Keep checksum data in the release metadata in sync when republishing assets
Never bypass the checksum check for untrusted sources
Delete and re-download the archive when verification fails rather than reusing it

When it happens

Trigger: Downloaded archive's computed SHA-256 differs from knownGitHubArchiveSha256 (the expected digest from the release/checksum data); thrown in InstallFromGitHubAsync called from InstallCoreAsync.

Common situations: Partial/corrupted download, CDN or proxy altering the bytes, a release asset republished with different contents but a stale checksum, or a compromised asset (the scenario the check exists for).

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/7c8ab95bc16e023a. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Cli/Agents/AspireSkills/AspireSkillsInstaller.cs:222

                {
                    return cachedResult;
                }
            }

            var archivePath = Path.Combine(tempDirectory.FullName, GetSafeFileName(asset.Name));
            if (!await TryDownloadGitHubAssetAsync(httpClient, asset.DownloadUrl, archivePath, cancellationToken).ConfigureAwait(false))
            {
                logger.LogDebug("Aspire skills GitHub release asset {AssetName} was unavailable for version {Version}.", asset.Name, version);
                return AcquisitionResult.Unavailable(knownGitHubArchiveSha256, githubReleaseMetadataAvailable);
            }

            try
            {
                var githubArchiveSha256 = ComputeArchiveSha256(archivePath);
                if (knownGitHubArchiveSha256 is not null &&
                    !string.Equals(githubArchiveSha256, knownGitHubArchiveSha256, StringComparison.OrdinalIgnoreCase))
                {
                    throw new InvalidDataException(string.Format(
                        CultureInfo.InvariantCulture,
                        "Aspire skills GitHub release asset '{0}' failed SHA-256 verification.",
                        asset.Name));
                }

                if (!validationDisabled)
                {
                    var provenanceResult = await githubArtifactAttestationVerifier.VerifyAsync(
                        GitHubRepository,
                        archivePath,
                        ExpectedSourceRepository,
                        ExpectedWorkflowPath,
                        ExpectedBuildType,
                        version,
                        cancellationToken).ConfigureAwait(false);

                    if (!provenanceResult.IsVerified)
                    {

View on GitHub (pinned to 25830f84bd)