---
title: "MGS1042: a remote spell does not match its digest"
description: Fires when a registry serves a manifest or layer for a pinned spell whose bytes do not hash to the digest magus.lock names, or when an offline load finds a cached copy that no longer matches. The import does not load.
tags: [MGS1042, magusfile, spells, imports, remote, oci, digest, integrity, magus.lock]
---

# MGS1042: a remote spell does not match its digest

The registry answered, but with bytes other than the ones `magus.lock` pins for the
import:

```text
[error] [MGS1042] remote spell ghcr.io/o/r/spells/x: the registry served bytes that do
not match the pin: oci: manifest does not match the digest its reference pins: ...
served sha256:<actual>
```

## Why

The digest is the only proof that the code about to run is the code the workspace chose
when it last ran the update charm. A registry is content-addressed, so a mismatch means
the host, a proxy, or something between them changed the bytes. magus cannot tell which,
so it loads nothing and caches nothing. Only the imports of that spell fail; the rest of
the workspace still loads.

## What to do

Do not rewrite the lock to the reported value until you know why it differs. Pull the
same digest from another network (`magus spell pull <path>` pulls exactly what the lock
pins), or ask the publisher for the digest their publish printed. See
[Remote spells](../../remote-spells.md).

## Offline

With `MAGUS_OFFLINE` set, magus never pulls, so a cached copy under
`$XDG_CACHE_HOME/magus/spells/` that no longer matches its pin fails with this code
rather than being refetched:

```text
[error] [MGS1042] remote spell ghcr.io/o/r/spells/x: the cached copy does not match the
pin and MAGUS_OFFLINE forbids a fresh pull: src/ does not match the layer
```

Something edited the cache. Unset `MAGUS_OFFLINE` once so magus replaces the entry, or
delete the `sha256-<digest>` directory it names and load again with a network.