rust-lang/cargo · error · anyhow::Error

failed to verify the checksum of `{}`

Error message

failed to verify the checksum of `{}`

What it means

Identical invariant to error 166 but for a *local* registry: `LocalRegistry::download` (src/sources/registry/local.rs:194) computes the SHA-256 of the on-disk `.crate` file and compares to the checksum from the index. A mismatch means the `.crate` blob on disk doesn't match what the index says it should be. (Cargo skips this check only when the unpacked source is already present.)

Source

Thrown at src/sources/registry/local.rs:196

        let path = self.root.join(&pkg.tarball_name()).into_path_unlocked();
        let mut crate_file = paths::open(&path)?;

        // If we've already got an unpacked version of this crate, then skip the
        // checksum below as it is in theory already verified.
        let dst = path.file_stem().unwrap();
        if self.src_path.join(dst).into_path_unlocked().exists() {
            return Ok(MaybeLock::Ready(crate_file));
        }

        if !self.quiet {
            self.gctx.shell().status("Unpacking", pkg)?;
        }

        // We don't actually need to download anything per-se, we just need to
        // verify the checksum matches the .crate file itself.
        let actual = Sha256::new().update_file(&crate_file)?.finish_hex();
        if actual != checksum {
            anyhow::bail!("failed to verify the checksum of `{}`", pkg)
        }

        crate_file.seek(SeekFrom::Start(0))?;

        Ok(MaybeLock::Ready(crate_file))
    }

    async fn finish_download(
        &self,
        _pkg: PackageId,
        _checksum: &str,
        _data: &[u8],
    ) -> CargoResult<File> {
        panic!("this source doesn't download")
    }
}

View on GitHub (pinned to 0e07a15537)

Solutions

1. Re-fetch or re-copy the offending `.crate` file so its bytes match the index checksum.
2. Recompute the correct SHA-256 of the file and update the index entry if the file is authoritative.
3. Regenerate the whole local registry from a trusted source/tool to ensure index and blobs agree.

Example fix

# verify and reconcile
sha256sum my-registry/foo-1.0.0.crate
# compare to checksum in my-registry/index/fo/o/foo
# replace the file or fix the index to match

// For a local registry, verify each .crate matches its indexed checksum before use.
fn verify_local_crate(crate_file: &Path, expected_sha256: &str) -> bool {
    let actual = sha256_file(crate_file);  // hex string
    actual == expected_sha256
}

When it happens

Trigger: A local-registry `.crate` file was modified, truncated, or replaced with a different version than the index declares; an index that lists the wrong checksum; a partially-copied registry tree.

Common situations: Manual edits to a vendored registry; a sync/copy that left a half-written `.crate`; mismatched index + crate versions after a partial `git pull` of the registry; registry generation tooling that computes checksums incorrectly.

Related errors

• failed to verify the checksum of `{}`
• local registry path is not a directory: {}
• local registry index path is not a directory: {}
• invalid tarball downloaded, contains a file at {entry_path:?
• invalid tarball downloaded, contains an entry at {entry_path

AI-assisted analysis of rust-lang/cargo@0e07a15537 (2026-08-06). Data as JSON: /data/errors/1819945c439fb753.json. Report an issue: GitHub.