error dep-checksum

What it means#

oxl.lock and the registry index store a content hash of every package (sha256: over the package files, D-6304). A downloaded package or a git checkout whose contents hash differently was changed after it was locked or published. A damaged entry of the local cache is downloaded again automatically; this error means the source itself no longer matches.

Example#

# oxl.lock
[[package]]
name = "util"
version = "1.0.0"
source = "registry+https://pkg.oxl.dev"
checksum = "sha256:0000…"   # <- dep-checksum: util 1.0.0 does not match its checksum

How to fix#

Do not edit oxl.lock by hand. If a registry serves different bytes for a published version, treat it as a security incident. For a git dependency whose tag was moved, run oxl update <name> after checking the new commit.

See also#

• dep-not-found
• lock-outdated