sdk swift must record the verified XCFramework package diges

Error message

sdk swift must record the verified XCFramework package digest

What it means

For the pinned Swift SDK (swiftpm/BoundaryML/baml-swift), the manifest must also include verified_package_sha256 — the digest of the verified XCFramework. A swift entry lacking this digest is rejected as unverifiable.

Source

Thrown at baml_language/crates/baml_release/src/manifest.rs:181

    }
    if let Some(digest) = &package.verified_package_sha256 {
        validate_sha256(digest)
            .map_err(|error| anyhow::anyhow!("sdk {language} package digest: {error}"))?;
    }
    if language == "csharp" {
        if package.registry != "nuget" || package.package != "baml-bridge" {
            anyhow::bail!("sdk csharp must identify nuget/baml-bridge");
        }
        if package.verified_package_sha256.is_none() {
            anyhow::bail!("sdk csharp must record the verified NuGet package digest");
        }
    }
    if language == "swift" {
        if package.registry != "swiftpm" || package.package != "BoundaryML/baml-swift" {
            anyhow::bail!("sdk swift must identify swiftpm/BoundaryML/baml-swift");
        }
        if package.verified_package_sha256.is_none() {
            anyhow::bail!("sdk swift must record the verified XCFramework package digest");
        }
    }
    Ok(())
}

#[cfg(test)]
mod tests {
    use super::*;

    fn full_target_artifacts() -> BTreeMap<String, Artifact> {
        SUPPORTED_RELEASE_TARGETS
            .iter()
            .map(|target| {
                (
                    (*target).to_string(),
                    Artifact {
                        url: format!("https://example.com/{target}.tar.gz"),
                        sha256: "a".repeat(64),

View on GitHub (pinned to bd85ce9dee)

Solutions

Compute the SHA-256 of the released XCFramework and set verified_package_sha256
Verify the digest against the checksum published with the baml-swift release
Regenerate the manifest with the release tooling to populate the digest

Example fix

// before
[sdk.swift]
registry = "swiftpm"
package = "BoundaryML/baml-swift"

// after
[sdk.swift]
registry = "swiftpm"
package = "BoundaryML/baml-swift"
verified_package_sha256 = "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"

Defensive patterns

Strategy: validation

Validate before calling

fn swift_digest_present(p: &SdkPackage) -> bool {
    p.verified_package_sha256.as_deref().map_or(false, |d| !d.is_empty())
}

Prevention

Hash the released XCFramework and store it in the manifest at release time
Cross-check against the checksum published with the baml-swift release
Treat verified_package_sha256 as required for swift, not optional

When it happens

Trigger: validate_sdk() sees language == "swift" with correct swiftpm/BoundaryML/baml-swift fields but verified_package_sha256 is None.

Common situations: Adding the swift SDK entry without computing the XCFramework digest; a manifest generator leaving the optional field null; removing the field during cleanup.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

AI-assisted analysis of BoundaryML/baml@bd85ce9dee (2026-09-12). Data as JSON: /api/errors/1960b5ad50c28ed4. Report an issue: GitHub.