sdk csharp must record the verified NuGet package digest

Error message

sdk csharp must record the verified NuGet package digest

What it means

For the pinned C# SDK (nuget/baml-bridge), the manifest must also include verified_package_sha256 — the digest of the verified NuGet package. A csharp entry without this digest is rejected because supply-chain verification is mandatory for this SDK.

Source

Thrown at baml_language/crates/baml_release/src/manifest.rs:173

    }
    validate_sha256(&artifact.sha256)?;
    Ok(())
}

fn validate_sdk(language: &str, package: &SdkPackage) -> anyhow::Result<()> {
    if package.registry.is_empty() || package.package.is_empty() || package.version.is_empty() {
        anyhow::bail!("sdk {language} has an empty registry, package, or version");
    }
    if let Some(digest) = &package.verified_package_sha256 {
        validate_sha256(digest)
            .map_err(|error| anyhow::anyhow!("sdk {language} package digest: {error}"))?;
    }
    if language == "csharp" {
        if package.registry != "nuget" || package.package != "baml-bridge" {
            anyhow::bail!("sdk csharp must identify nuget/baml-bridge");
        }
        if package.verified_package_sha256.is_none() {
            anyhow::bail!("sdk csharp must record the verified NuGet package digest");
        }
    }
    if language == "swift" {
        if package.registry != "swiftpm" || package.package != "BoundaryML/baml-swift" {
            anyhow::bail!("sdk swift must identify swiftpm/BoundaryML/baml-swift");
        }
        if package.verified_package_sha256.is_none() {
            anyhow::bail!("sdk swift must record the verified XCFramework package digest");
        }
    }
    Ok(())
}

#[cfg(test)]
mod tests {
    use super::*;

    fn full_target_artifacts() -> BTreeMap<String, Artifact> {

View on GitHub (pinned to bd85ce9dee)

Solutions

Compute the NuGet package's SHA-256 and set verified_package_sha256 for the csharp entry
If unsure of the digest, download the .nupkg from nuget.org and run sha256sum on it
Regenerate the manifest with the release tooling, which populates the digest automatically

Example fix

// before
[sdk.csharp]
registry = "nuget"
package = "baml-bridge"

// after
[sdk.csharp]
registry = "nuget"
package = "baml-bridge"
verified_package_sha256 = "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"

Defensive patterns

Strategy: validation

Validate before calling

fn csharp_digest_present(p: &SdkPackage) -> bool {
    p.verified_package_sha256.as_deref().map_or(false, |d| !d.is_empty())
}

Prevention

Always record the NuGet package digest when adding a csharp SDK entry
Download the .nupkg and hash it before finalizing the manifest
Treat verified_package_sha256 as required for csharp, not optional

When it happens

Trigger: validate_sdk() sees language == "csharp" with correct nuget/baml-bridge fields but verified_package_sha256 set to None (field absent or null).

Common situations: Adding the csharp SDK entry for the first time and skipping the digest; a generator that leaves the optional field unset; stripping 'optional' fields during a manifest cleanup.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

AI-assisted analysis of BoundaryML/baml@bd85ce9dee (2026-09-12). Data as JSON: /api/errors/1fab90868bd344c3. Report an issue: GitHub.