rust-lang/rust · critical · RuntimeError

failed verification

Error message

failed verification

What it means

Raised by get() in bootstrap.py at line 82 after a freshly downloaded stage0 artifact fails SHA-256 verification. The function downloads the file to a temp path, calls verify(temp_path, sha256, verbose), and if it returns false, raises RuntimeError('failed verification'). This is a supply-chain integrity guard: the downloaded binary does not match the pinned checksum from src/stage0.

Source

Thrown at src/bootstrap/bootstrap.py:82

                ).format(url)
            )
        sha256 = checksums[url]
        if os.path.exists(path):
            if verify(path, sha256, False):
                if verbose > 0:
                    eprint("using already-download file", path)
                return
            else:
                if verbose > 0:
                    eprint(
                        "ignoring already-download file",
                        path,
                        "due to failed verification",
                    )
                os.unlink(path)
        download(temp_path, "{}/{}".format(base, url), True, verbose)
        if not verify(temp_path, sha256, verbose):
            raise RuntimeError("failed verification")
        if verbose > 0:
            eprint("moving {} to {}".format(temp_path, path))
        shutil.move(temp_path, path)
    finally:
        if os.path.isfile(temp_path):
            if verbose > 0:
                eprint("removing", temp_path)
            os.unlink(temp_path)


def curl_version():
    m = re.match(bytes("^curl ([0-9]+)\\.([0-9]+)", "utf8"), require(["curl", "-V"]))
    if m is None:
        return (0, 0)
    return (int(m[1]), int(m[2]))


def download(path, url, probably_big, verbose):

View on GitHub (pinned to 7088e4b63a)

Solutions

1. Delete the partial download in the build directory and re-run x.py to fetch a fresh copy.
2. Verify network connectivity and retry; if behind a proxy, bypass it for static.rust-lang.org.
3. Ensure src/stage0 matches the commit of the rust-lang/rust checkout (git checkout/restore src/stage0).
4. Manually download the artifact and compute its sha256 to compare against the stage0 checksum, then investigate the discrepancy.

# Pre-verify an existing file's checksum before re-downloading
import hashlib
def verify_file(path, expected_sha256):
    h = hashlib.sha256()
    with open(path, 'rb') as f:
        for chunk in iter(lambda: f.read(8192), b''):
            h.update(chunk)
    return h.hexdigest() == expected_sha256

import time
for attempt in range(3):
    try:
        get(base, url, path, checksums, verbose)
        break
    except RuntimeError as e:
        if 'failed verification' in str(e) and attempt < 2:
            print(f'Checksum failed, retrying download ({attempt+1}/3)...')
            time.sleep(2 ** attempt)
            continue
        raise

When it happens

Trigger: get() downloads the artifact to temp_path at line 80, then verify() at line 81 returns False. verify() computes the SHA-256 of the file and compares it to the checksums[url] value. A mismatch means the downloaded bytes differ from the known-good hash. Triggers: corrupted download (network error, truncation), a MITM or compromised mirror, or an out-of-sync stage0 file whose checksums don't match what the server actually serves.

Common situations: Unstable network causing a truncated download; a corporate proxy that modifies the download; the stage0 file was edited to point at a different server/commit but checksums weren't updated; or a CDN caching issue serving a stale or wrong artifact.

Related errors

• src/stage0 doesn't contain a checksum for {}. Pre-built arti
• no cargo executable found at `{}`
• failed to run: {args}
• {} not found
• Unrecognized config profile '{}'. Check src/bootstrap/defaul

AI-assisted analysis of rust-lang/rust@7088e4b63a (2026-08-10). Data as JSON: /api/errors/42797a5ec9018cc7. Report an issue: GitHub.