Skip to content

verify-download reports hash mismatch because checklist.chk uses MD5 while the CLI computes SHA-256 #515

Description

@DhineshPonnarasan

Description

Summary

llama model verify-download currently reports a hash mismatch for downloaded files because Meta's checklist.chk contains MD5 checksums, while the verification code computes SHA-256.

As a result, the expected and computed digests can never match.

Current behavior

For a downloaded model, running:

llama model verify-download --model-id Llama3.2-3B

can produce results such as:

❌ consolidated.00.pth: Hash mismatch
Expected: 8f0bfb9428f98a4d52c294aadb485f66
Got:      e85237a45033593adb3eb7e1a6cc5c410c4e2b360e24a422d3c1ab12a166c441

The expected value is 32 hexadecimal characters (MD5), while the computed value is 64 hexadecimal characters (SHA-256).

Expected behavior

verify-download should calculate the same checksum algorithm represented by checklist.chk, allowing successfully downloaded files to pass verification.

Root cause

models/cli/verify_download.py currently uses hashlib.sha256() when calculating the file digest.

The checksum manifest distributed with Meta's Llama downloads is in MD5 format. The existing checklist parser already extracts the expected checksum correctly; the mismatch occurs because the verification step calculates the wrong digest algorithm.

This is also consistent with the Llama 3 download script, which verifies the manifest using:

md5sum -c checklist.chk

The CLI's download output also refers to the files as MD5 checksum files.

Related issue

This appears to be the same underlying problem reported in #428.

Proposed fix

Update verify-download so that it computes MD5 when verifying the current Meta checklist.chk format.

The change should preserve the existing CLI behavior and remain limited to checksum verification.

Tests

Add regression coverage for:

  • parsing an MD5-format checklist.chk
  • successful checksum verification
  • checksum mismatch
  • missing files
  • known MD5 digest calculation
  • an end-to-end verification using a temporary directory and synthetic checklist.chk

Scope

This issue is specifically about the checksum algorithm used by verify-download.

It does not propose changes to the downloader's retry/resume behavior or other download architecture.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions