What causes "SHA512 mismatch: expected %s, got %s" in twpayne/chezmoi?

Recompute with curl -sL | sha512sum and update checksum.sha512.

SHA512 mismatch: expected %s, got %s

Error message

SHA512 mismatch: expected %s, got %s

What it means

The SHA512 branch of external checksum verification: if external.Checksum.SHA512 is set and sha512Sum(data) differs from it, this mismatch error is appended to errs and later joined and wrapped with the external's relative path.

Source

Thrown at internal/chezmoi/sourcestate.go:1745

	if external.Checksum.SHA256 != nil {
		if gotSHA256Sum := sha256.Sum256(data); !bytes.Equal(gotSHA256Sum[:], external.Checksum.SHA256) {
			format := "SHA256 mismatch: expected %s, got %s"
			err := fmt.Errorf(format, external.Checksum.SHA256, hex.EncodeToString(gotSHA256Sum[:]))
			errs = append(errs, err)
		}
	}

	if external.Checksum.SHA384 != nil {
		if gotSHA384Sum := sha384Sum(data); !bytes.Equal(gotSHA384Sum, external.Checksum.SHA384) {
			errs = append(errs, fmt.Errorf("SHA384 mismatch: expected %s, got %s",
				external.Checksum.SHA384, hex.EncodeToString(gotSHA384Sum)))
		}
	}

	if external.Checksum.SHA512 != nil {
		if gotSHA512Sum := sha512Sum(data); !bytes.Equal(gotSHA512Sum, external.Checksum.SHA512) {
			errs = append(errs, fmt.Errorf("SHA512 mismatch: expected %s, got %s",
				external.Checksum.SHA512, hex.EncodeToString(gotSHA512Sum)))
		}
	}

	if len(errs) != 0 {
		return nil, urlStr, fmt.Errorf("%s: %w", externalRelPath, errors.Join(errs...))
	}

	if external.Encrypted {
		data, err = s.encryption.Decrypt(data)
		if err != nil {
			return nil, urlStr, fmt.Errorf("%s: %s: %w", externalRelPath, urlStr, err)
		}
	}

	data, err = decompress(external.Decompress, data)
	if err != nil {
		return nil, urlStr, fmt.Errorf("%s: %w", externalRelPath, err)

View on GitHub (pinned to f901167e46)

Solutions

Recompute with curl -sL <url> | sha512sum and update checksum.sha512.
Alternatively standardize on checksum.sha256 for consistency.
Check the digest length/format (hex, not base64).
Confirm the URL pins an immutable artifact (tag commit or release asset), not a moving 'latest' file.

Example fix

// before
checksum.sha512 = "cf83e1357eefb8bd..."
// after
checksum.sha512 = "<sha512sum of the current artifact>"

Defensive patterns

Strategy: validation

Validate before calling

curl -sL "$URL" | sha512sum
# Compare with checksum.sha512 (128 hex chars) before applying.

Try / catch

out, err := exec.Command("chezmoi", "apply").CombinedOutput()
if err != nil && strings.Contains(string(out), "SHA512 mismatch") {
    return errors.New("recompute checksum.sha512 or switch to sha256")
}

Prevention

Never hash a sibling file (e.g. the .sig) by mistake.
Keep exactly one checksum digest per external to reduce maintenance.
Bump the checksum in the same commit/PR that bumps the URL version.

When it happens

Trigger: External entry declares checksum.sha512; the downloaded data's SHA512 digest does not equal the declared value.

Common situations: Pinned release artifact replaced upstream; digest transcribed incorrectly (must be 128 hex chars); hashing the wrong artifact variant (e.g. .sig file instead of the tarball).

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

AI-assisted analysis of twpayne/chezmoi@f901167e46 (2026-09-01). Data as JSON: /api/errors/0d9ce0f23b00d47a. Report an issue: GitHub.