Description
Summary
llama model verify-download currently reports a hash mismatch for downloaded files because Meta's checklist.chk contains MD5 checksums, while the verification code computes SHA-256.
As a result, the expected and computed digests can never match.
Current behavior
For a downloaded model, running:
llama model verify-download --model-id Llama3.2-3B
can produce results such as:
❌ consolidated.00.pth: Hash mismatch
Expected: 8f0bfb9428f98a4d52c294aadb485f66
Got: e85237a45033593adb3eb7e1a6cc5c410c4e2b360e24a422d3c1ab12a166c441
The expected value is 32 hexadecimal characters (MD5), while the computed value is 64 hexadecimal characters (SHA-256).
Expected behavior
verify-download should calculate the same checksum algorithm represented by checklist.chk, allowing successfully downloaded files to pass verification.
Root cause
models/cli/verify_download.py currently uses hashlib.sha256() when calculating the file digest.
The checksum manifest distributed with Meta's Llama downloads is in MD5 format. The existing checklist parser already extracts the expected checksum correctly; the mismatch occurs because the verification step calculates the wrong digest algorithm.
This is also consistent with the Llama 3 download script, which verifies the manifest using:
The CLI's download output also refers to the files as MD5 checksum files.
Related issue
This appears to be the same underlying problem reported in #428.
Proposed fix
Update verify-download so that it computes MD5 when verifying the current Meta checklist.chk format.
The change should preserve the existing CLI behavior and remain limited to checksum verification.
Tests
Add regression coverage for:
- parsing an MD5-format
checklist.chk
- successful checksum verification
- checksum mismatch
- missing files
- known MD5 digest calculation
- an end-to-end verification using a temporary directory and synthetic
checklist.chk
Scope
This issue is specifically about the checksum algorithm used by verify-download.
It does not propose changes to the downloader's retry/resume behavior or other download architecture.
Description
Summary
llama model verify-downloadcurrently reports a hash mismatch for downloaded files because Meta'schecklist.chkcontains MD5 checksums, while the verification code computes SHA-256.As a result, the expected and computed digests can never match.
Current behavior
For a downloaded model, running:
can produce results such as:
The expected value is 32 hexadecimal characters (MD5), while the computed value is 64 hexadecimal characters (SHA-256).
Expected behavior
verify-downloadshould calculate the same checksum algorithm represented bychecklist.chk, allowing successfully downloaded files to pass verification.Root cause
models/cli/verify_download.pycurrently useshashlib.sha256()when calculating the file digest.The checksum manifest distributed with Meta's Llama downloads is in MD5 format. The existing checklist parser already extracts the expected checksum correctly; the mismatch occurs because the verification step calculates the wrong digest algorithm.
This is also consistent with the Llama 3 download script, which verifies the manifest using:
The CLI's download output also refers to the files as MD5 checksum files.
Related issue
This appears to be the same underlying problem reported in #428.
Proposed fix
Update
verify-downloadso that it computes MD5 when verifying the current Metachecklist.chkformat.The change should preserve the existing CLI behavior and remain limited to checksum verification.
Tests
Add regression coverage for:
checklist.chkchecklist.chkScope
This issue is specifically about the checksum algorithm used by
verify-download.It does not propose changes to the downloader's retry/resume behavior or other download architecture.