deployApp() fails with "bad checksum" when uploading bundle to shinyapps.io

[ChaitaC]

Description

Summary

Deploying a Shiny app to shinyapps.io with deployApp() fails with a "bad checksum" HTTP 400 error during bundle upload. This happens consistently with the dev version of rsconnect installed from GitHub.

GithubRepo: | rsconnect
-- | --
GithubUsername: | rstudio
GithubRef: | HEAD
GithubSHA1: | 591e6527751f08f6d75ab0109ef4ca1406341b5f

Steps to reproduce

1. remotes::install_github("rstudio/rsconnect")
2. rsconnect::deployApp(appDir = "/path/to/shiny/app")

Error

Error in POST():
! https://api.shinyapps.io/v1/bundles/11663820 failed with HTTP status 400
bad checksum

with options(rsconnect.httr2 = FALSE) App deployment succeeds:

> options(rsconnect.httr2 = FALSE)   
> getOption("rsconnect.httr2")  
[1] FALSE
> rsconnect::deployApp(appDir = "/Users/cchaudhari/shinyapp/shinyapp", appName = "shinyapp-1")
── Preparing for deployment ───────────────────────────────────────────────────────────────────
✔ Re-deploying "shinyapp-1" using "server: shinyapps.io / username: chaitatest"
ℹ Looking up content with id "16818495"...
✔ Found content <https://chaitatest.shinyapps.io/shinyapp-1/>
ℹ Bundling 1 file: app.R
ℹ Capturing R dependencies
✔ Found 30 dependencies
✔ Created bundle of size: 20,241b
ℹ Uploading bundle...
✔ Uploaded bundle with id 11663834
── Deploying to server ────────────────────────────────────────────────────────────────────────
Waiting for task: 1659510191
  building: Building image: 14484050
  building: Fetching packages
  building: Installing packages
  building: Installing files
  building: Pushing image: 14484050
  deploying: Starting instances
  rollforward: Activating new instances
  success: Stopping old instances
── Deployment complete ────────────────────────────────────────────────────────────────────────
✔ Successfully deployed to <https://chaitatest.shinyapps.io/shinyapp-1/>

with > options(rsconnect.httr2 = TRUE) app deployment fails

> options(rsconnect.httr2 = TRUE)
> getOption("rsconnect.httr2")  
[1] TRUE
> rsconnect::deployApp(appDir = "/Users/cchaudhari/shinyapp/shinyapp", appName = "shinyapp-1")
── Preparing for deployment ───────────────────────────────────────────────────────────────────
✔ Re-deploying "shinyapp-1" using "server: shinyapps.io / username: chaitatest"
ℹ Looking up content with id "16818495"...
✔ Found content <https://chaitatest.shinyapps.io/shinyapp-1/>
ℹ Bundling 1 file: app.R
ℹ Capturing R dependencies
✔ Found 30 dependencies
✔ Created bundle of size: 20,243b
ℹ Uploading bundle...
Error in `POST()`:
! <https://api.shinyapps.io/v1/bundles/11663843> failed with HTTP status 400
bad checksum
Run `rlang::last_trace()` to see where the error occurred.

Your environment

No response

[ChaitaC]

Might be related to #1284

[nealrichardson]

Doing some RTFSing, my best guess is that shinyapps is rejecting ‎X-Content-Checksum. We should make sure the header is being sent, first of all (it should be, the headers are getting passed in here), and then my next guess would be that the way that httr2 streams the file to libcurl somehow transforms somehow (that seems really unlikely though, and wouldn't explain why the same issue wouldn't cause failures on Connect).

An alternative, if we don't think this is worth tracking down, or can't solve it: locally set rsconnect.httr2 = FALSE in the function that uploads to shinyapps (

rsconnect/R/client-shinyapps.R

Line 76 in 591e652

POST_JSON(service, authInfo, "/bundles", json)

).

Might also be nice to add a simple test, like the simple Connect integration test, that runs against shinyapps.io, so we don't miss stuff like this again.

[ChaitaC]

I enabled verbose HTTP output and it looks like a 303 redirect problem.

The X-Content-Checksum header is being sent correctly. The problem appears to be that httr2 automatically follows a 303 redirect from the updateBundleStatus call, replaying the auth headers but dropping the body.

From the verbose output:

Original request (has body):

  -> POST /v1/bundles/11666493/status HTTP/2
  -> X-Content-Checksum: 3487edaa55bdda95d1553d82ce17e1de
  -> Content-Type: application/json
  -> Content-Length: 23
  <- HTTP/2 303
  <- location: https://api.shinyapps.io/v1/bundles/11666493

Redirected request (body dropped, stale checksum):

 -> POST /v1/bundles/11666493 HTTP/2
  -> X-Content-Checksum: 3487edaa55bdda95d1553d82ce17e1de
  -> Content-Type: application/json
  ->
  <- HTTP/2 400

Note Content-Length: 23 on the first request and no Content-Length on the redirect. The checksum header stays the same but now describes a body that's no longer there.

Verbose logs

> options(rsconnect.http.verbose = TRUE)
> options(rsconnect.httr2 = TRUE)
> rsconnect::deployApp(appDir = "/Users/cchaudhari/shinyapp/shinyapp", appName = "shinyapp-1")
── Preparing for deployment ───────────────────────────────────────────────────────────────────
✔ Re-deploying "shinyapp-1" using "server: shinyapps.io / username: chaitatest"
ℹ Looking up content with id "16818495"...
-> GET /v1/applications/16818495 HTTP/2
-> Host: api.shinyapps.io
-> User-Agent: RSConnect/1.7.0.9000
-> Accept: */*
-> Accept-Encoding: deflate, gzip
-> Date: Thu, 05 Mar 2026 12:32:57 GMT
-> X-Auth-Token: ABD3A5510FCB0XXXXXXXXXXXXXXXXX
-> X-Auth-Signature: YjAzNTRjYTU5MTQwYzA5MGM4MTEyZjEzNjZkZjQ1NDRiMjdkNTc0YWQ4NDQzNjU1NDBjYjFkNDRkNTM1N2M0Ng==; version=1
-> X-Content-Checksum: d41d8cd98f00b204e9800998ecf8427e
-> 
<- HTTP/2 200 
<- date: Thu, 05 Mar 2026 12:32:58 GMT
<- content-type: application/json; charset=UTF-8
<- content-length: 4781
<- etag: "212bf81c78bbaf829e6297f964e71ee9fda3877e"
<- 
✔ Found content <https://chaitatest.shinyapps.io/shinyapp-1/>
ℹ Bundling 1 file: app.R
ℹ Capturing R dependencies
✔ Found 30 dependencies
✔ Created bundle of size: 20,244b
ℹ Uploading bundle...
-> POST /v1/bundles HTTP/2
-> Host: api.shinyapps.io
-> User-Agent: RSConnect/1.7.0.9000
-> Accept: */*
-> Accept-Encoding: deflate, gzip
-> Date: Thu, 05 Mar 2026 12:32:58 GMT
-> X-Auth-Token: ABD3A5510FCB0XXXXXXXXXXXXXXXXX
-> X-Auth-Signature: MGViZGFhZjAwZmE4NmEzZGJkZWRiZjNlN2RhMzZlNGMyOWIxY2IyNjEzYTU4MDA2NjFmODA2ZDgzNzU3Mjk0YQ==; version=1
-> X-Content-Checksum: 5ead1357b9a581f3f5ba01c53f6a1b1d
-> Content-Type: application/json
-> Content-Length: 145
-> 
<- HTTP/2 201 
<- date: Thu, 05 Mar 2026 12:32:59 GMT
<- content-type: application/json; charset=UTF-8
<- content-length: 2048
<- 
* Host shinyapps-upload.s3.amazonaws.com:443 was resolved.
* IPv6: (none)
* IPv4: 3.5.7.170, 3.5.7.21, 52.216.221.185, 52.217.17.156, 52.216.58.41, 52.216.217.9, 3.5.24.236, 16.182.67.217
*   Trying 3.5.7.170:443...
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-AES128-GCM-SHA256 / [blank] / UNDEF
* ALPN: server accepted http/1.1
* Server certificate:
*  subject: CN=s3.amazonaws.com
*  start date: Sep 19 00:00:00 2025 GMT
*  expire date: Aug 23 23:59:59 2026 GMT
*  subjectAltName: host "shinyapps-upload.s3.amazonaws.com" matched cert's "*.s3.amazonaws.com"
*  issuer: C=US; O=Amazon; CN=Amazon RSA 2048 M01
*  SSL certificate verify ok.
* Connected to shinyapps-upload.s3.amazonaws.com (3.5.7.170) port 443
* using HTTP/1.x
> PUT /bundles/application-16818495/2beb05dcbc144f5d97c9ff34004b1579.tar.gz?AWSAccessKeyId=ASIA54P7SCTK5HECDAYX&Signature=Znq%2FW5faRf%2FQIGZBs8iINgsbs8E%3D&content-md5=TkyLmMO2Q4I6DZc%2BwOU%2BQg%3D%3D&content-type=application%2Fx-tar&x-amz-security-token=IQoJb3JpZ2luX2VjEAUaCXVzLWVhc3QtMSJHMEUCIQClRVtbRODfPEbjEnSHlkeIdTvcUSz%2Bb0hut0WYxFUYmQIgIghuiQnn2YghlAR%2Fpngb9Egqrq0KElNzXjpZ4qGNtg8qjgUIzf%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5NTQ1NTU1NjkzNjUiDLLY7v9h3awECCClqiriBP1vhOyPqephgny%2FKoNHX5hYdk%2F4ouYzSlycIlOlud0AiTu6n4I5%2F%2FFiA2HXnpfW1De%2FuX3%2FAr%2F%2BMcuh7RaSEQwFyrSGZaPGHNU%2FwBbFs4p%2FRhF3bgYMEaNf65sLtGiffz6j6RaXGt22OgvHxmxLXCOm78CcglKFOhG6pUHBb2JpmssnVdjC195b3sOvHr5R5aD5nELSS%2FCxlUnHgURwBzbo9RYOElz0sBJXMHJjPNQCPaCOcEWokG%2BaETO0SpWd4LQHuxbN2pDA0Fp%2B0kEYjENccdQZNcymwpgIos1lcrG3N2C%2BTxxt7IkP3GGHS6gjUss9YUWnE9Jz%2FAP%2F44FxpL9bR9x%2Bcxv7ctZf440q7Fpbo%2B8tByi%2F7zyXNTLFgLsF7rQK2HNFAul57A57ENEIlKMUXc3bSJ9T0vodlY9pWjaP6FFO7UIYBpfUlFrSEyMpsQ3r7j6qIEjnKDtGt%2Fa5V8HmfESvCR%2FhWRWoTDQ%2Fbo0DAOoCwlp%2BF7LAsyt%2Bu07HFD78V8TP1tca2zGHN0xZqdkq%2B1wrUDe5RQpSMRVzmZ1KIH3xW6IIdEomonqRGRvKMj9p94zdHjtoFN5gh%2BakqmlPRnj8PlvtqqYLS%2Fi97VPWVsQyv9BnMQYAvroVVFhoNlmu31zS1BSzhcaR%2F4edxXhf4H2gCT0OfH2LbKTq4%2BJCOVBdpCvMY0x%2BlmiBGQKpwdxTNmdm%2Fip6iPIs6CDLoa3IEo3dCoyDz7vprSIVpLmNdhRUT6kyEbYawYstpF%2BrorQfqolHSdPK7K%2FJUl7vEK%2B3spCATsiAX3EPphF2zRL48u8w3OWlzQY6mAFanYslPAKr3CB7dkQTgO%2FXV68Ll2Nh0KBZFmw99odFkb8VCN0jXuziwhRTGi8Vo2poGkvWm6wDDhDEoipYow7RMYJr0WB7PEMMg02HP6HrS57cG%2FKgMECzQp8bytjKn%2FY6gaXDfGlK%2F4zHmosQJ09sBnFf6wRMroJRlig%2BAE3zGR5%2B0AWLcxuWlddT0LOQPPCnJg9zqpxUSg%3D%3D&Expires=1772717579 HTTP/1.1
Host: shinyapps-upload.s3.amazonaws.com
User-Agent: RSConnect/1.7.0.9000
Accept: */*
Accept-Encoding: deflate, gzip
Content-Type: application/x-tar
Content-Length: 20244
Content-MD5: TkyLmMO2Q4I6DZc+wOU+Qg==

* upload completely sent off: 20244 bytes
< HTTP/1.1 200 OK
< x-amz-id-2: oX4qRHEgRcuThovy3KOjQhUS8uZxmLDXWcNM5XOKoTrFDhL7U1vKIznL4QR/X34gYSCVa9fbNp4PpVENQ+Efmg==
< x-amz-request-id: 75V51KYJPHNZPCSM
< Date: Thu, 05 Mar 2026 12:33:00 GMT
< x-amz-server-side-encryption: AES256
< ETag: "4e4c8b98c3b643823a0d973ec0e53e42"
< x-amz-checksum-crc64nvme: fmqHz7eUh2U=
< x-amz-checksum-type: FULL_OBJECT
< Content-Length: 0
< Server: AmazonS3
< 
* Connection #2 to host shinyapps-upload.s3.amazonaws.com left intact
-> POST /v1/bundles/11666493/status HTTP/2
-> Host: api.shinyapps.io
-> User-Agent: RSConnect/1.7.0.9000
-> Accept: */*
-> Accept-Encoding: deflate, gzip
-> Date: Thu, 05 Mar 2026 12:32:59 GMT
-> X-Auth-Token: ABD3A5510FCB0XXXXXXXXXXXXXXXXX
-> X-Auth-Signature: M2QxOGFhY2Q2N2U3ZmZhNDM3Y2ZjMmQwYWY2ODY0MzQ3N2MwMTM2YjVlYWNhYTVjMTg4MDAxODVmOGQ2ZjM1ZQ==; version=1
-> X-Content-Checksum: 3487edaa55bdda95d1553d82ce17e1de
-> Content-Type: application/json
-> Content-Length: 23
-> 
<- HTTP/2 303 
<- date: Thu, 05 Mar 2026 12:32:59 GMT
<- content-type: text/html; charset=UTF-8
<- content-length: 0
<- location: https://api.shinyapps.io/v1/bundles/11666493
<- 
-> POST /v1/bundles/11666493 HTTP/2
-> Host: api.shinyapps.io
-> User-Agent: RSConnect/1.7.0.9000
-> Accept: */*
-> Accept-Encoding: deflate, gzip
-> Date: Thu, 05 Mar 2026 12:32:59 GMT
-> X-Auth-Token: ABD3A5510FCB0XXXXXXXXXXXXXXXXX
-> X-Auth-Signature: M2QxOGFhY2Q2N2U3ZmZhNDM3Y2ZjMmQwYWY2ODY0MzQ3N2MwMTM2YjVlYWNhYTVjMTg4MDAxODVmOGQ2ZjM1ZQ==; version=1
-> X-Content-Checksum: 3487edaa55bdda95d1553d82ce17e1de
-> Content-Type: application/json
-> 
<- HTTP/2 400 
<- date: Thu, 05 Mar 2026 12:32:59 GMT
<- content-type: application/json; charset=UTF-8
<- content-length: 25
<- 
Error in `POST()`:
! <https://api.shinyapps.io/v1/bundles/11666493> failed with HTTP status 400
bad checksum
Run `rlang::last_trace()` to see where the error occurred.