Skip to content
Yocto Project build errors

do_fetch: Fetcher failure, checksum mismatch

What a sha256sum mismatch in do_fetch means, why it happens, and how to fix the recipe safely.

do_fetch
ERROR: myapp-1.0-r0 do_fetch: Checksum mismatch! File: 'myapp-1.0.tar.gz' has sha256 checksum '9c1e…' when 'a41f…' was expected

What happens

do_fetch downloaded the source archive, but its sha256 checksum is not the one declared in the recipe (SRC_URI[sha256sum]). bitbake refuses to use it.

Why

  • Upstream re-released the tarball under the same name (it happens with auto-generated archives).
  • SRC_URI points to another version than the one the checksum was computed for (a PV change without a checksum update).
  • Less often, a mirror or proxy served a different or truncated file.

How to fix it

  1. Check the origin first: compare with the upstream announcement or a signature. Never accept a new checksum blindly; it is your supply-chain check.
  2. Update the checksum in the recipe or in a .bbappend of your layer: SRC_URI[sha256sum] = "<new sha256>".
  3. Remove the bad file from DL_DIR if a mirror served it, and fetch again: bitbake -c fetch -f myapp.

Never disable the checksum verification.