zeroclaw-labs/zeroclaw · error · anyhow::Error

checksum mismatch for '{asset_name}': expected {expected_hex

Error message

checksum mismatch for '{asset_name}': expected {expected_hex}, got {actual_hex}. The downloaded update may be corrupted or tampered with.

What it means

Error "checksum mismatch for '{asset_name}': expected {expected_hex}, got {actual_hex}. The downloaded update may be corrupted or tampered with." thrown in zeroclaw-labs/zeroclaw.

Source

Thrown at src/commands/update.rs:539

        .context("failed to read SHA256SUMS body")?;
    verify_checksum_bytes(bytes, &asset_name, &sums_text)?;

    ::zeroclaw_log::record!(
        INFO,
        ::zeroclaw_log::Event::new(module_path!(), ::zeroclaw_log::Action::Note)
            .with_outcome(::zeroclaw_log::EventOutcome::Success)
            .with_attrs(::serde_json::json!({"asset": asset_name})),
        "Update download checksum verified"
    );
    Ok(())
}

fn verify_checksum_bytes(bytes: &[u8], asset_name: &str, sums_text: &str) -> Result<()> {
    let expected_hex = expected_sha256_for_asset(sums_text, asset_name)?;
    let actual_hex = hex::encode(Sha256::digest(bytes));

    if !actual_hex.eq_ignore_ascii_case(expected_hex) {
        bail!(
            "checksum mismatch for '{asset_name}': expected {expected_hex}, got {actual_hex}. \
             The downloaded update may be corrupted or tampered with."
        );
    }

    Ok(())
}

fn asset_name_from_url(url: &str) -> Option<String> {
    reqwest::Url::parse(url)
        .ok()?
        .path_segments()?
        .next_back()
        .filter(|name| !name.is_empty())
        .map(str::to_string)
}

fn expected_sha256_for_asset<'a>(sums_text: &'a str, asset_name: &str) -> Result<&'a str> {

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Delete the downloaded artifact and re-run the update to get a fresh copy.
2. If the mismatch persists, do not install; verify the release checksums from the official source and report a possible tampering issue.

When it happens

Trigger: Thrown at src/commands/update.rs:539 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/6e2bbda12c64701a. Report an issue: GitHub.