BoundaryML/baml · warning

checksum for '%s' not found within file %s

Error message

checksum for '%s' not found within file %s

What it means

The checksum file downloaded successfully, but no line contains a checksum entry for the target filename. downloadChecksum returns this plain error so the caller skips verification with a warning rather than failing the download.

Source

Thrown at engine/language_client_go/baml_go/lib_common.go:619

			checksum, filenameInLine := parts[0], strings.TrimPrefix(parts[1], "*")
			if filenameInLine == targetFilename {
				if len(checksum) == 64 && isHex(checksum) {
					logger.Debug("Found matching checksum in file", "filename", targetFilename, "checksum", checksum)
					return checksum, nil
				}
				logger.Warn("Invalid checksum format found in checksum file",
					"url", checksumURL,
					"filename", targetFilename,
					"found_checksum", checksum)
				return "", fmt.Errorf("invalid checksum format '%s' for %s in %s", checksum, targetFilename, checksumURL)
			}
		}
	}

	logger.Warn("Checksum for target file not found within checksum file",
		"url", checksumURL,
		"target_filename", targetFilename)
	return "", fmt.Errorf("checksum for '%s' not found within file %s", targetFilename, checksumURL)
}

func isHex(s string) bool {
	if len(s) == 0 {
		return false
	}
	for _, r := range s {
		if !((r >= '0' && r <= '9') || (r >= 'a' && r <= 'f') || (r >= 'A' && r <= 'F')) {
			return false
		}
	}
	return true
}

func copyFile(src, dst string) (err error) {
	logger.Debug("Attempting to copy file", "source", src, "destination", dst)
	source, err := os.Open(src)
	if err != nil {

View on GitHub (pinned to bd85ce9dee)

Solutions

1. Verify targetFilename matches exactly the name in the checksum file (case, platform suffix, version)
2. Check upstream release assets for the correct checksum file covering this platform
3. Regenerate the checksum file including all platform artifacts
4. Proceed with verification skipped — the caller warns and continues

Example fix

// before: name mismatch with checksum file entry
name := "libbaml.so"
// after: include platform/version as published upstream
name := fmt.Sprintf("libbaml_%s_%s_%s.so", version, runtime.GOOS, runtime.GOARCH)

// verify the target name exists in the checksum file before downloading the lib
// (fetch file, split lines, check any line's fields contain targetFilename)

if _, err := downloadChecksum(url, name); err != nil && strings.Contains(err.Error(), "not found within file") {
    logger.Warn("artifact missing from checksum file; verification skipped")
    // proceed with download, verification will be skipped
}

When it happens

Trigger: The checksum file lists other artifacts but not targetFilename — e.g. a multi-artifact checksum file missing the entry for this platform's library, or a filename mismatch (different naming convention or version suffix).

Common situations: Upstream release published checksums only for some platforms, filename changed between releases (renamed library) while checksum file uses the old name, or OS/arch string mismatch in the constructed target filename.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• {kind} artifact failed integrity validation
• sha256 mismatch for {url}: expected {expected}, got {got}
• Checksum file did not contain an entry for {archive_name}
• blob size mismatch for {}; expected {} bytes, got {} bytes
• blob digest mismatch for {}; computed {}

AI-assisted analysis of BoundaryML/baml@bd85ce9dee (2026-09-12). Data as JSON: /api/errors/e499fccfb36f9bb2. Report an issue: GitHub.