Error: Error downloading checksum file: connection reset by peer (Packer)

Error: Error downloading checksum file: ... read: connection reset by peer (Packer)

TL;DR

The checksum file download was interrupted. Retry the build, and if the mirror is flaky, pin the hash directly (sha256:[hash]) so no download is needed.

The error

Error: 1 error(s) occurred:

* Error downloading checksum file: Get "https://cloud-images.ubuntu.com/releases/22.04/release-20230815/SHA256SUMS": read tcp CONTAINER_IP:35328->185.12.5.190.37:443: read: connection reset by peer in "file:https://cloud-images.ubuntu.com/releases/22.04/release-20230815/SHA256SUMS"

Fix it

1. Retry packer validate / packer build. Connection resets are often transient.

• Success check: the checksum downloads on retry.

1. If it keeps failing, fetch the checksum file yourself with curl and confirm the mirror is reachable.

• Success check: you can download it outside Packer.

1. For reliability, pin the hash: replace iso_checksum = "file:[url]" with iso_checksum = "sha256:[hash]" using the hash from the file.

• Success check: no network fetch happens at validate time.

1. In CI, cache the checksum file or the hash in a variable file so builds do not depend on the mirror.

• Success check: builds are hermetic.

When to use this

You hit this at validate time when the file: checksum URL is unreachable or flaky.

When NOT to use this

Do not use this for no checksum found in: (the file downloaded but could not be parsed) or for hash mismatches.

Compatibility

Packer 1.x, any builder using iso_checksum = "file:...".

Variants

• Error downloading checksum file with DNS failures, 403s, or timeouts instead of resets
• The build continuing past a failed checksum download in some versions (then failing later at ISO verification)

Root cause

file: checksums require a network fetch at validate time. Any interruption (reset, timeout, mirror outage) fails validation before the build starts.

Edge cases

• Parallel builds (-parallel-builds=8) multiply the fetch load and the flake rate. Pinning the hash helps most there.
• IPv6-only or proxied CI runners may fail where your laptop succeeds. Test from the runner.