rust-lang/cargo · error · anyhow::Error

checksum for `{}` was not previously calculated, but a check

Error message

checksum for `{}` was not previously calculated, but a checksum could now be calculated

this could be indicative of a few possible situations:

    * the source `{}` did not previously support checksums,
      but was replaced with one that does
    * newer Cargo implementations know how to checksum this source, but this
      older implementation does not
    * the lock file is corrupt

What it means

During `merge_previous` (reconciling the new resolution with the prior `Cargo.lock` checksums): the old lockfile had no checksum for a package (`cksum.is_none()`) but the current resolution computed one. This asymmetry suggests the source's checksum capability changed between runs — e.g. a non-checksummed source was replaced with one that checksums.

Source

Thrown at src/resolver/resolve.rs:237

        // * A replacement source wasn't actually a replacement, some changes
        //   were made
        //
        // In all of these cases, we want to report an error to indicate that
        // something is awry. Normal execution (esp just using crates.io) should
        // never run into this.
        for (id, cksum) in previous.checksums.iter() {
            if let Some(mine) = self.checksums.get(id) {
                if mine == cksum {
                    continue;
                }

                // If the previous checksum wasn't calculated, the current
                // checksum is `Some`. This may indicate that a source was
                // erroneously replaced or was replaced with something that
                // desires stronger checksum guarantees than can be afforded
                // elsewhere.
                if cksum.is_none() {
                    anyhow::bail!(
                        "\
checksum for `{}` was not previously calculated, but a checksum could now \
be calculated

this could be indicative of a few possible situations:

    * the source `{}` did not previously support checksums,
      but was replaced with one that does
    * newer Cargo implementations know how to checksum this source, but this
      older implementation does not
    * the lock file is corrupt
",
                        id,
                        id.source_id()
                    )

                // If our checksum hasn't been calculated, then it could mean
                // that future Cargo figured out how to checksum something or

View on GitHub (pinned to 0e07a15537)

Solutions

Regenerate the lockfile with the current Cargo: `cargo generate-lockfile`.
Remove the `[source]` replacement that changed the checksum behavior, or make it consistent across the team.
Ensure all developers use the same Cargo version to avoid checksum-capability drift.
If the lockfile is corrupt, delete `Cargo.lock` and let Cargo rebuild it.

Example fix

# before: .cargo/config.toml replaces crates.io with a non-checksummed mirror
[source.crates-io]
replace-with = "vendored-sources"
# after: remove the replacement or ensure the mirror provides checksums
cargo generate-lockfile

Defensive patterns

Strategy: validation

Validate before calling

# Keep source-replacement config consistent; regenerate lockfile after changes:
# .cargo/config.toml reviewed into git, then:
cargo generate-lockfile

Prevention

Standardize Cargo version across the team via `rust-toolchain.toml`.
Regenerate `Cargo.lock` whenever you change `[source]` replacements.
Avoid mixing checksummed and non-checksummed sources for the same crate.

When it happens

Trigger: A `[source]` replacement swapped a source that didn't provide checksums (some git/path/directory sources) with one that does, so `previous.checksums[id]` was `None` but `self.checksums[id]` is now `Some`. Also triggered by an older Cargo's lockfile being read by a newer Cargo that learned to checksum that source.

Common situations: Switching a dependency from a git source to crates.io (or vice versa via replacement); upgrading Cargo across a version that added checksum support for a source kind; a corrupted/partially-written `Cargo.lock` missing a `checksum` field.

Related errors

AI-assisted analysis of rust-lang/cargo@0e07a15537 (2026-08-06). Data as JSON: /data/errors/b0739efa5f3bcfcd.json. Report an issue: GitHub.