CPM.cmake fetch failure / hash mismatch in CI

By Daniel Zoghalchali·Latchkey

CPM.cmake wraps CMake FetchContent to download dependencies at configure time. A failure is either a network problem reaching the source, or a URL_HASH that does not match the downloaded archive. The message from FetchContent names which.

What this error means

CMake configure fails during a CPMAddPackage step with "Download failed", "HASH mismatch", or "each download failed" and the URL it tried.

CMake Error at cmake/CPM.cmake:...
  Hash mismatch for file: fmt-10.2.1.tar.gz
    expected: 'SHA256=1250e4c...'
      actual: 'SHA256=00000000...'

Common causes

A wrong or stale URL_HASH

The pinned hash does not match the archive the source now serves (a re-tagged release, a changed tarball, or a mistyped hash).

A transient download failure

GitHub or the release host returned a partial or failed download, so FetchContent could not retrieve the archive.

How to fix it

Correct the pinned hash

1. Download the archive and compute its SHA256 locally.
2. Update URL_HASH (or the CPM VERSION/GIT_TAG pin) to the real value.
3. Re-run configure so the hash matches.

sha256sum fmt-10.2.1.tar.gz

Cache CPM sources and retry transient fetches

Persist the CPM source cache so downloads are reused, and retry when the failure is a transient network drop.

env:
  CPM_SOURCE_CACHE: ${{ github.workspace }}/.cache/cpm

How to prevent it

• Set CPM_SOURCE_CACHE and persist it so fetches are cached across runs.
• Pin dependencies by immutable tag or verified hash.
• Regenerate the hash whenever you bump the pinned version.

Frequently asked questions

Related guides

References

• CMake documentation
• GitHub Actions documentation