BoundaryML/baml · error

sdk {language} package digest: {error}

Error message

sdk {language} package digest: {error}

What it means

If an SdkPackage provides an optional verified_package_sha256, it is checked with validate_sha256. When that check fails, the underlying error is wrapped with the language name so you know which SDK's digest is bad.

Source

Thrown at baml_language/crates/baml_release/src/manifest.rs:166

    }
    Ok(())
}

fn validate_artifact(name: &str, artifact: &Artifact) -> anyhow::Result<()> {
    if !artifact.url.starts_with("https://") {
        anyhow::bail!("artifact {name} URL must use HTTPS");
    }
    validate_sha256(&artifact.sha256)?;
    Ok(())
}

fn validate_sdk(language: &str, package: &SdkPackage) -> anyhow::Result<()> {
    if package.registry.is_empty() || package.package.is_empty() || package.version.is_empty() {
        anyhow::bail!("sdk {language} has an empty registry, package, or version");
    }
    if let Some(digest) = &package.verified_package_sha256 {
        validate_sha256(digest)
            .map_err(|error| anyhow::anyhow!("sdk {language} package digest: {error}"))?;
    }
    if language == "csharp" {
        if package.registry != "nuget" || package.package != "baml-bridge" {
            anyhow::bail!("sdk csharp must identify nuget/baml-bridge");
        }
        if package.verified_package_sha256.is_none() {
            anyhow::bail!("sdk csharp must record the verified NuGet package digest");
        }
    }
    if language == "swift" {
        if package.registry != "swiftpm" || package.package != "BoundaryML/baml-swift" {
            anyhow::bail!("sdk swift must identify swiftpm/BoundaryML/baml-swift");
        }
        if package.verified_package_sha256.is_none() {
            anyhow::bail!("sdk swift must record the verified XCFramework package digest");
        }
    }
    Ok(())

View on GitHub (pinned to bd85ce9dee)

Solutions

1. Replace the digest with the correct 64-character lowercase hexadecimal SHA-256 of the package
2. Recompute it (e.g. sha256sum <package file>) and re-paste without prefixes or whitespace
3. If you cannot verify the digest yet, remove the verified_package_sha256 field (unless required, e.g. csharp/swift)

Example fix

// before
verified_package_sha256 = "SHA256:9F86D081884C7D65..."

// after
verified_package_sha256 = "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"

fn is_valid_sha256(d: &str) -> bool {
    d.len() == 64 && d.bytes().all(|b| b.is_ascii_hexdigit() && !b.is_ascii_uppercase())
}

When it happens

Trigger: validate_sdk() is given a manifest entry with a verified_package_sha256 that fails validate_sha256 — typically not a 64-char lowercase hex string, or a malformed/empty digest.

Common situations: Pasting a SHA-256 with 'sha256:' prefix or uppercase hex; truncating the digest; putting an md5 or sha1 hash in the field.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• invalid SHA-256 checksum `{hash}`
• no baml.toml found from {} up to the home directory Run this
• {kind} artifact failed integrity validation
• {path}: missing `[package]` table. Add: [package] n
• {path}: `[package]` is missing `name = "<your-project-name>"

AI-assisted analysis of BoundaryML/baml@bd85ce9dee (2026-09-12). Data as JSON: /api/errors/748f11c7b39656ec. Report an issue: GitHub.