nikivdev/code · critical

checksum mismatch for {} (expected {}, got {})

Error message

checksum mismatch for {} (expected {}, got {})

What it means

In the upgrade `run` flow (src/upgrade.rs:~660), the downloaded checksums.txt is parsed for the tarball's expected SHA-256 and compared against `sha256_file(&temp_tarball)`. On any difference the upgrade refuses to install. This is an integrity guard against corrupted or tampered downloads.

Source

Thrown at src/upgrade.rs:665

        println!("[dry-run] Would install to: {}", output_path.display());
        return Ok(());
    }

    // Download the release
    let temp_tarball = env::temp_dir().join("flow_upgrade.tar.gz");
    download_with_progress(&client, &tarball_asset.browser_download_url, &temp_tarball)?;

    let insecure = env_truthy("FLOW_UPGRADE_INSECURE");
    if let Some(asset) = checksums_asset {
        let temp_checksums = env::temp_dir().join("flow_upgrade_checksums.txt");
        download_with_progress(&client, &asset.browser_download_url, &temp_checksums)?;
        let checksums = fs::read_to_string(&temp_checksums)
            .context("failed to read downloaded checksums.txt")?;

        if let Some(expected) = parse_sha256_from_checksums(&checksums, &tarball_asset.name) {
            let actual = sha256_file(&temp_tarball)?;
            if expected.to_lowercase() != actual.to_lowercase() {
                bail!(
                    "checksum mismatch for {} (expected {}, got {})",
                    tarball_asset.name,
                    expected,
                    actual
                );
            }
            println!("Checksum verified.");
        } else if insecure {
            eprintln!(
                "Warning: checksums.txt does not contain {}; skipping checksum verification (FLOW_UPGRADE_INSECURE=1).",
                tarball_asset.name
            );
        } else {
            bail!(
                "checksums.txt does not contain {}. Refusing to install.\n\
                 Set FLOW_UPGRADE_INSECURE=1 to bypass (not recommended).",
                tarball_asset.name
            );

View on GitHub (pinned to a747e741ae)

Solutions

1. Delete the cached tarball and retry the upgrade to rule out a corrupted download.
2. Verify manually: `sha256sum <tarball>` and compare to the release's checksums.txt.
3. Disable or bypass any HTTP proxy/mirror cache and retry.
4. Check the GitHub release — if it was re-published, wait for consistent assets or report to maintainers.
5. Investigate network security (corporate TLS interception) if mismatch persists.

# verify integrity yourself before trusting the download
EXPECTED=$(awk -v f="$ASSET_NAME" '$2==f{print $1}' checksums.txt)
ACTUAL=$(sha256sum "$TARBALL" | cut -d' ' -f1)
[ "${EXPECTED,,}" = "${ACTUAL,,}" ] || { echo "checksum mismatch — do not install"; exit 1; }

When it happens

Trigger: `parse_sha256_from_checksums` found an entry for the asset, but `expected.to_lowercase() != actual.to_lowercase()` — the computed hash of the downloaded tarball differs from the published one.

Common situations: Truncated download over flaky network/proxy; a caching proxy or mirror serving a stale/modified artifact; MITM tampering; the asset was re-uploaded (release re-cut) after checksums.txt was generated.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• checksum mismatch for {}
• checksums.txt does not contain {}. Refusing to install. Set

AI-assisted analysis of nikivdev/code@a747e741ae (2026-09-01). Data as JSON: /api/errors/4fb50372cd0a145d. Report an issue: GitHub.