BoundaryML/baml · error · io::Error

unsupported blob algorithm `{}`

Error message

unsupported blob algorithm `{}`

What it means

BlobArtifact::validate checks that the artifact's algorithm field equals the only supported value, SHA-256 (ALGORITHM_SHA256); anything else yields InvalidData with the unsupported algorithm name. The library deliberately supports a single digest algorithm to keep artifact digests interoperable.

Source

Thrown at baml_language/crates/bex_events/src/value/artifact.rs:39

    const SHA256_HEX_LEN: usize = 64;

    #[must_use]
    pub fn sha256(bytes: &[u8]) -> Self {
        let digest = Sha256::digest(bytes);
        let mut hex = String::with_capacity(digest.len() * 2);
        for byte in digest {
            let _ = write!(&mut hex, "{byte:02x}");
        }
        Self {
            algorithm: Self::ALGORITHM_SHA256.to_string(),
            digest: hex,
            size_bytes: bytes.len(),
        }
    }

    pub fn validate(&self) -> io::Result<()> {
        if self.algorithm != Self::ALGORITHM_SHA256 {
            return Err(io::Error::new(
                io::ErrorKind::InvalidData,
                format!("unsupported blob algorithm `{}`", self.algorithm),
            ));
        }
        if self.digest.len() != Self::SHA256_HEX_LEN {
            return Err(io::Error::new(
                io::ErrorKind::InvalidData,
                format!(
                    "invalid sha256 blob digest length {}; expected {} hex characters",
                    self.digest.len(),
                    Self::SHA256_HEX_LEN
                ),
            ));
        }
        if !self.digest.bytes().all(|byte| byte.is_ascii_hexdigit()) {
            return Err(io::Error::new(
                io::ErrorKind::InvalidData,
                "invalid sha256 blob digest; expected only hex characters",

View on GitHub (pinned to bd85ce9dee)

Solutions

1. Set the artifact's algorithm to BlobArtifact::ALGORITHM_SHA256 (the only supported value).
2. Re-produce the blob artifact using bex_events' own artifact constructor so digest and algorithm are consistent.
3. Update the producer tool/library if it emits a different algorithm.
4. Call validate() early on deserialized artifacts to reject unsupported ones before use.

Example fix

// before
let mut a = BlobArtifact { algorithm: "md5".into(), ..meta };
a.validate()?;
// after
let mut a = BlobArtifact { algorithm: BlobArtifact::ALGORITHM_SHA256.into(), ..meta };
a.validate()?;

if artifact.algorithm != BlobArtifact::ALGORITHM_SHA256 {
    return Err(format!("unsupported blob algorithm: {}", artifact.algorithm));
}
if artifact.digest.len() != BlobArtifact::SHA256_HEX_LEN {
    return Err("digest must be 64 hex chars".into());
}

fn is_sha256_artifact(a: &BlobArtifact) -> bool {
    a.algorithm == BlobArtifact::ALGORITHM_SHA256
        && a.digest.len() == BlobArtifact::SHA256_HEX_LEN
}

match artifact.validate() {
    Err(e) if e.kind() == std::io::ErrorKind::InvalidData => {
        log::warn!("rejecting artifact: {e}");
        Err(ArtifactError::Unsupported)
    }
    other => other,
}

When it happens

Trigger: Constructing or deserializing a BlobArtifact whose algorithm field was set to something other than "sha256" (e.g. from an older format, hand-built struct, or external producer), then calling validate() — also reached via normalized_digest.

Common situations: Artifacts produced by another tool/version using a different hash algorithm; manually editing artifact metadata; copying blob metadata between files and changing the algorithm field.

Related errors

• AWS Bedrock only supports text system blocks, but got {other
• {kind} artifact is truncated
• {kind} is not a versioned BAML artifact; {}
• invalid {kind} artifact header: {message}
• expected {expected} artifact, found {actual}

AI-assisted analysis of BoundaryML/baml@bd85ce9dee (2026-09-12). Data as JSON: /api/errors/89d795a6cf555fd6. Report an issue: GitHub.