tinyhumansai/openhuman · critical · Error

[openhuman] Checksum mismatch!\n expected: ${expectedChecks

Error message

[openhuman] Checksum mismatch!\n  expected: ${expectedChecksum}\n  got:      ${actualChecksum}

What it means

Integrity gate of the npm installer: the sha256 of the downloaded core tarball must equal the first whitespace-separated token of the published checksum file. A mismatch means the bytes on disk are not the bytes the release signed off, so the bad archive is deleted and install aborts.

Source

Thrown at packages/npm/install.js:122

  if (fs.existsSync(binDest)) {
    console.log('[openhuman] Binary already installed, skipping download.');
    return;
  }

  console.log(`[openhuman] Downloading v${VERSION} for ${target}...`);

  // Download checksum first (small)
  const checksumData = await httpsGet(`${baseUrl}/${checksumFile}`);
  const expectedChecksum = checksumData.toString('utf8').trim().split(/\s+/)[0];

  // Download binary archive
  await downloadFile(`${baseUrl}/${tarball}`, tmpTarball);

  // Verify checksum
  const actualChecksum = sha256hex(tmpTarball);
  if (expectedChecksum !== actualChecksum) {
    fs.rmSync(tmpTarball, { force: true });
    throw new Error(
      `[openhuman] Checksum mismatch!\n  expected: ${expectedChecksum}\n  got:      ${actualChecksum}`
    );
  }
  console.log('[openhuman] Checksum verified.');

  // Extract — use execFileSync (no shell interpolation) so paths with spaces
  // or shell metacharacters in `tmpTarball` / `binDir` can't be injected.
  if (isWin) {
    // PowerShell is available on Windows runners
    execFileSync(
      'powershell',
      [
        '-NoProfile',
        '-NonInteractive',
        '-Command',
        `Expand-Archive -Path $env:TC_SRC -DestinationPath $env:TC_DEST -Force`,
      ],
      { stdio: 'inherit', env: { ...process.env, TC_SRC: tmpTarball, TC_DEST: binDir } }

View on GitHub (pinned to a221052e0d)

Solutions

1. Re-run the install after clearing cached artifacts (npm cache clean --force, remove the tmp tarball dir) so a fresh download re-verifies
2. Retry from a network without TLS-intercepting proxies and with AV live-scanning disabled for the download
3. If it persists, compare the two hex digests in the message against the published release and file an issue — never bypass the check

// Before trusting a downloaded archive, verify it yourself:
const { createHash } = require('crypto');
const actual = createHash('sha256').update(fs.readFileSync(tarball)).digest('hex');
if (actual !== expected) { fs.rmSync(tarball, { force: true }); /* re-download */ }

try {
  await install();
} catch (e) {
  if (String(e.message).includes('Checksum mismatch')) {
    // corrupted transfer: clear cache and retry once with a clean download
    await cleanTmpAndRetry();
    return;
  }
  throw e;
}

When it happens

Trigger: Truncated or corrupted download (dropped connection, disk full mid-write); TLS-inspection proxy or antivirus rewriting bytes; CDN/version skew where the checksum file and tarball resolve to different releases.

Common situations: Corporate proxies mangling binaries; flaky CI network; a partially propagated release where checksums were updated before artifacts.

Related errors

• Unsupported platform: ${platform}
• Unsupported arch ${arch} on ${platform}
• [openhuman] Extraction failed — binary not found after unpac
• Invalid ${paramName}: ${String(value)}. Type must be an inte
• OpenRouter OAuth callback state did not match the request.

AI-assisted analysis of tinyhumansai/openhuman@a221052e0d (2026-08-16). Data as JSON: /api/errors/3cf7feb657b4d5a6. Report an issue: GitHub.