rust-lang/cargo · error · anyhow::Error

the listed checksum of `{}` has changed: expected: {} actual

Error message

the listed checksum of `{}` has changed:
expected: {}
actual:   {}

directory sources are not intended to be edited, if modifications are required then it is recommended that `[patch]` is used with a forked copy of the source

What it means

During directory source `verify`: the SHA-256 computed from a file on disk doesn't match the checksum recorded in that package's `.cargo-checksum.json`. Directory (vendored) sources are immutable by design — Cargo verifies file integrity before use. A mismatch means a file was edited, corrupted, or replaced, breaking the integrity guarantee.

Source

Thrown at src/sources/directory.rs:246

    fn fingerprint(&self, pkg: &Package) -> CargoResult<String> {
        Ok(pkg.package_id().version().to_string())
    }

    fn verify(&self, id: PackageId) -> CargoResult<()> {
        let packages = self.packages.borrow_mut();
        let Some((pkg, cksum)) = packages.get(&id) else {
            anyhow::bail!("failed to find entry for `{}` in directory source", id);
        };

        for (file, cksum) in cksum.files.iter() {
            let file = pkg.root().join(file);
            let actual = Sha256::new()
                .update_path(&file)
                .with_context(|| format!("failed to calculate checksum of: {}", file.display()))?
                .finish_hex();
            if &*actual != cksum {
                anyhow::bail!(
                    "the listed checksum of `{}` has changed:\n\
                     expected: {}\n\
                     actual:   {}\n\
                     \n\
                     directory sources are not intended to be edited, if \
                     modifications are required then it is recommended \
                     that `[patch]` is used with a forked copy of the \
                     source\
                     ",
                    file.display(),
                    cksum,
                    actual
                );
            }
        }

        Ok(())
    }

View on GitHub (pinned to 0e07a15537)

Solutions

1. Re-run `cargo vendor <dir>` to restore pristine checksums.
2. If you genuinely need to modify the source, use `[patch]` pointing at a forked copy rather than editing the vendor directory in place.
3. Disable git line-ending conversion for the vendor path (`git config core.autocrlf false`) or add a `.gitattributes` with `binary`.

Example fix

# before: edited vendored crate source file
# after
[patch.crates-io]
foo = { path = "../my-foo-fork" }

# Detect modified vendored files before building:
find vendor -type f ! -name '.cargo-checksum.json' -exec sha256sum {} + \
  | sort  # compare against recorded checksums; any diff = integrity failure
# Or simply re-vendor:
cargo vendor vendor

When it happens

Trigger: Any modification (even whitespace) to a file inside a vendored crate directory after `cargo vendor` ran; a file deleted and recreated with different content; filesystem/git line-ending or encoding transformations; partial/corrupted vendor extraction.

Common situations: Editing a vendored crate to apply a quick patch instead of using `[patch]`; git `autocrlf` converting line endings in vendored files; a CI cache serving a stale/modified vendor dir; manual file moves that altered content.

Related errors

• checksum for `{}` was not previously calculated, but a check
• checksum for `{}` could not be calculated, but a checksum is
• checksum for `{}` changed between lock files this could be
• failed to find entry for `{}` in directory source
• failed to verify the checksum of `{}`

AI-assisted analysis of rust-lang/cargo@0e07a15537 (2026-08-06). Data as JSON: /data/errors/6d581ac18affd81b.json. Report an issue: GitHub.