BoundaryML/baml · error

network error fetching checksum %s: %w

Error message

network error fetching checksum %s: %w

What it means

downloadChecksum fetches the .sha256 file over HTTP; this error is returned when the HTTP client itself fails (DNS failure, connection refused, TLS error), wrapping the underlying error. It is deliberately raised with an uninstrumented HTTP client during init().

Source

Thrown at engine/language_client_go/baml_go/lib_common.go:580

	logger.Debug("Setting permissions for library file", "path", destPath, "mode", "0755")
	if err := os.Chmod(destPath, 0755); err != nil {
		logger.Warn("Failed to set permissions (chmod 0755)", "path", destPath, "error", err)
	}

	logger.Info("Successfully downloaded and cached BAML library", "path", destPath)
	return nil
}

//orchestrion:ignore
func downloadChecksum(checksumURL string, targetFilename string) (string, error) {
	// Use uninstrumented client to avoid Orchestrion crash during init()
	//orchestrion:ignore
	httpClient := uninstrumentedHTTPClient()
	//orchestrion:ignore
	resp, err := httpClient.Get(checksumURL)
	if err != nil {
		return "", fmt.Errorf("network error fetching checksum %s: %w", checksumURL, err)
	}
	defer resp.Body.Close()

	if resp.StatusCode == http.StatusNotFound {
		logger.Debug("Checksum file not found (404)", "url", checksumURL)
		return "", fmt.Errorf("checksum file not found (404)")
	}
	if resp.StatusCode != http.StatusOK {
		return "", fmt.Errorf("unexpected status %d fetching checksum %s", resp.StatusCode, checksumURL)
	}

	bodyBytes, err := io.ReadAll(io.LimitReader(resp.Body, 4096))
	if err != nil {
		return "", fmt.Errorf("error reading checksum body %s: %w", checksumURL, err)
	}

	lines := strings.Split(string(bodyBytes), "\n")
	for _, line := range lines {

View on GitHub (pinned to bd85ce9dee)

Solutions

1. Check network connectivity and DNS resolution for the checksum host
2. Configure HTTP_PROXY/HTTPS_PROXY if behind a corporate proxy
3. Verify the checksum URL scheme/host is reachable (curl the URL)
4. Note the library tolerates missing checksums downstream; ensure upstream handling treats this as skippable verification

Example fix

// before
resp, err := httpClient.Get(checksumURL)
// after (caller-side): tolerate missing checksum with a warning
if checksum, cerr := downloadChecksum(url, name); cerr != nil {
    logger.Warn("Checksum unavailable, skipping verification", "err", cerr)
} else { _ = checksum }

resp, err := http.Get(checksumURL)
if err == nil { resp.Body.Close() } // probe reachability before install

if checksum, err := downloadChecksum(url, name); err != nil {
    logger.Warn("checksum fetch failed, skipping verification", "err", err)
    // optionally retry with backoff before giving up
}

When it happens

Trigger: httpClient.Get(checksumURL) returns a transport-level error: no network, DNS resolution failure, TLS handshake failure, or proxy misconfiguration.

Common situations: Developer is offline or behind a corporate proxy, DNS blocked for the distribution CDN host, or a firewall blocks the checksum endpoint while the main download URL is allowlisted.

Related errors

• error reading checksum body %s: %w
• Auth server returned {status}: {body}
• PostHog returned {status}
• network error fetching {url}: {source}
• HTTP {status} fetching {url}

AI-assisted analysis of BoundaryML/baml@bd85ce9dee (2026-09-12). Data as JSON: /api/errors/c23348df1f8f3790. Report an issue: GitHub.