CHW-2305 ChecksumMismatch
artifact checksum mismatch: upstream-declared hash disagrees with downloaded bytes; inspect the X-Chainsaw-Checksum-Mismatch header or raise CHAINSAW_CHECKSUM_MODE=log if this is a known-false-posi…
Default message: artifact checksum mismatch: upstream-declared hash disagrees with downloaded bytes; inspect the X-Chainsaw-Checksum-Mismatch header or raise CHAINSAW_CHECKSUM_MODE=log if this is a known-false-positive mirror
HTTP status:403(client)
Reason:CHECKSUM_MISMATCH
Problem. A download was refused because the artifact’s computed
hash did not match the registry-declared hash. Cause. The proxy
re-hashed the bytes and detected an upstream / network disagreement;
under CHAINSAW_CHECKSUM_MODE=quarantine (the default) or block
the request fails. The response carries
X-Chainsaw-Checksum-Mismatch: <ecosystem>/<declared>/<actual> so
operators can audit the disagreement without re-downloading.
Fix. Inspect the header to confirm the mismatch, re-fetch from a
healthy mirror, or set CHAINSAW_CHECKSUM_MODE=log if this is a
known-false-positive mirror. HTTP 403 — a checksum mismatch is a policy
decision (“do not serve a tampered artifact”), not a transient
availability problem, so it is terminal and CI runners must not retry it.