siyuan-note/siyuan · error

verify checksum failed, download install package [%s] checks

Error message

verify checksum failed, download install package [%s] checksum [%s] not equal to downloaded [%s] checksum [%s]

What it means

Returned by downloadInstallPkg after a successful HTTP GET when the SHA-256 of the saved file does not equal the expected checksum. The download completed but the bytes on disk are not byte-identical to what the release signed off. The incomplete/invalid file is removed (os.Remove) and the error is logged via logging.LogError before returning. The message embeds the package URL, expected checksum, save path, and observed checksum for forensics.

Source

Thrown at kernel/model/updater.go:175

	logging.LogInfof("downloading install package [%s]", pkgURL)
	client := req.C().SetTLSHandshakeTimeout(7 * time.Second).SetTimeout(10 * time.Minute).DisableInsecureSkipVerify().SetUserAgent(util.UserAgent)
	callback := func(info req.DownloadInfo) {
		progress := fmt.Sprintf("%.2f%%", float64(info.DownloadedSize)/float64(info.Response.ContentLength)*100.0)
		// logging.LogDebugf("downloading install package [%s %s]", pkgURL, progress)
		util.PushStatusBar(fmt.Sprintf(Conf.Language(133), progress))
	}
	_, err = client.R().SetOutputFile(savePath).SetDownloadCallbackWithInterval(callback, 1*time.Second).Get(pkgURL)
	if err != nil {
		logging.LogErrorf("download install package [%s] failed: %s", pkgURL, err)
		if removeErr := os.Remove(savePath); nil != removeErr && !os.IsNotExist(removeErr) {
			logging.LogErrorf("remove incomplete install package [%s] failed: %s", savePath, removeErr)
		}
		return
	}

	localChecksum, _ := sha256Hash(savePath)
	if checksum != localChecksum {
		err = fmt.Errorf("verify checksum failed, download install package [%s] checksum [%s] not equal to downloaded [%s] checksum [%s]", pkgURL, checksum, savePath, localChecksum)
		logging.LogError(err.Error())
		if removeErr := os.Remove(savePath); nil != removeErr && !os.IsNotExist(removeErr) {
			logging.LogErrorf("remove invalid install package [%s] failed: %s", savePath, removeErr)
		}
		return
	}
	logging.LogInfof("downloaded install package [%s] to [%s]", pkgURL, savePath)
	util.PushStatusBar(Conf.Language(62))
	return
}

func sha256Hash(filename string) (ret string, err error) {
	file, err := os.Open(filename)
	if err != nil {
		return
	}
	defer file.Close()

View on GitHub (pinned to 251596fc0d)

Solutions

1. Retry the download; transient corruption usually resolves on the next attempt, and downloadInstallPkg already removed the bad file.
2. Try a different mirror by switching update channel or region (IsChinaCloud toggles mirror ordering).
3. Verify disk space and that no antivirus/backup tool is locking the install temp dir (util.TempDir/install).
4. If the observed checksum is stable across retries, suspect the mirror — download the package manually from GitHub and compare checksums.

// Retry the download across mirror URLs; each bad file is auto-removed.
var lastErr error
for _, url := range downloadPkgURLs {
    if err := downloadInstallPkg(url, checksum); err == nil {
        return nil
    } else {
        lastErr = err
    }
}
return lastErr

When it happens

Trigger: Network corruption or a proxy that altered bytes mid-transfer. The download was interrupted and the HTTP client wrote a partial body yet reported success. A mirror (b3log/liuyun/ghproxy) served a stale or wrong-version file with the same name. Disk write error or filesystem corruption truncated the file. A man-in-the-middle swapped the binary.

Common situations: Unstable connection that drops bytes without closing the socket. CDN cache poisoning where a mirror serves an older release's binary under the new version's filename. Disk full or antivirus locking the file mid-write on Windows. Corporate proxy re-encoding content.

Related errors

• checksum manifest digest mismatch
• update package is unavailable: [%s] checksum is unavailable
• checksum manifest is too large
• encrypted .sy [%s]: base id [%s] != root id [%s]
• update package URL or checksum is empty

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/3b60ca3d6a38b535. Report an issue: GitHub.