rust-lang/cargo · error · anyhow::Error

checksum for `{}` could not be calculated, but a checksum is

Error message

checksum for `{}` could not be calculated, but a checksum is listed in the existing lock file

this could be indicative of a few possible situations:

    * the source `{}` supports checksums,
      but was replaced with one that doesn't
    * the lock file is corrupt

unable to verify that `{0}` is the same as when the lockfile was generated

What it means

The mirror of error 148: the previous lockfile listed a checksum for a package, but the current resolution could not compute one (`mine.is_none()`). This means a source that previously provided checksums was replaced with one that doesn't, so Cargo can no longer verify the package is identical to what was locked.

Source

Thrown at src/resolver/resolve.rs:259

this could be indicative of a few possible situations:

    * the source `{}` did not previously support checksums,
      but was replaced with one that does
    * newer Cargo implementations know how to checksum this source, but this
      older implementation does not
    * the lock file is corrupt
",
                        id,
                        id.source_id()
                    )

                // If our checksum hasn't been calculated, then it could mean
                // that future Cargo figured out how to checksum something or
                // more realistically we were overridden with a source that does
                // not have checksums.
                } else if mine.is_none() {
                    anyhow::bail!(
                        "\
checksum for `{}` could not be calculated, but a checksum is listed in \
the existing lock file

this could be indicative of a few possible situations:

    * the source `{}` supports checksums,
      but was replaced with one that doesn't
    * the lock file is corrupt

unable to verify that `{0}` is the same as when the lockfile was generated
",
                        id,
                        id.source_id()
                    )

                // If the checksums aren't equal, and neither is None, then they
                // must both be Some, in which case the checksum now differs.

View on GitHub (pinned to 0e07a15537)

Solutions

1. Configure the replacement source to provide checksums (most registries/mirrors should).
2. Remove the `replace-with` source replacement if checksum integrity matters.
3. Regenerate the lockfile (`cargo generate-lockfile`) so it no longer expects a checksum for the now-unchecksummed source.
4. Switch to a replacement source (e.g. a proper registry mirror) that supports checksums.

Example fix

# before: mirror without checksums
[source.crates-io]
replace-with = "local-mirror"
[source.local-mirror]
directory = "./vendor"  # no checksums
# after
[source.crates-io]
replace-with = "registry-mirror"
[source.registry-mirror]
registry = "https://mirror.example/index"

# Verify the replacement source supports checksums before switching:
# prefer a real registry mirror over a bare directory source.
# After config change:
cargo generate-lockfile && cargo build

When it happens

Trigger: A `[source]` replacement pointing crates.io at a local/path/git mirror that does not emit checksums, while `Cargo.lock` still records the original crates.io checksum. The `else if mine.is_none()` branch fires during `merge_previous`.

Common situations: Switching to a vendor directory or git mirror via `.cargo/config.toml` `replace-with`; using a private registry that doesn't implement checksums; Cargo downgrade after an upgrade that computed checksums.

Related errors

• checksum for `{}` was not previously calculated, but a check
• checksum for `{}` changed between lock files this could be
• the listed checksum of `{}` has changed: expected: {} actual
• a Cargo.lock must exist for this command
• cannot specify both recursive and precise simultaneously

AI-assisted analysis of rust-lang/cargo@0e07a15537 (2026-08-06). Data as JSON: /data/errors/1ea7ab8f19ba74f7.json. Report an issue: GitHub.