Hmbown/CodeWhale · error · anyhow::Error

invalid SHA256 manifest line {}: {trimmed}

Error message

invalid SHA256 manifest line {}: {trimmed}

What it means

parse_checksum_manifest rejects a nonempty manifest line shorter than 66 bytes: a valid line needs at least 64 hex characters plus a whitespace separator plus a nonempty filename. Short lines usually mean the wrong digest algorithm (MD5 gives 32 hex chars) or a truncated/garbled checksums file.

Source

Thrown at crates/cli/src/update.rs:1154

fn select_checksum_manifest_asset(release: &Release) -> Option<&Asset> {
    release
        .assets
        .iter()
        .find(|asset| asset.name == CHECKSUM_MANIFEST_ASSET)
}

fn parse_checksum_manifest(text: &str) -> Result<HashMap<String, String>> {
    let mut checksums = HashMap::new();

    for (index, line) in text.lines().enumerate() {
        let trimmed = line.trim();
        if trimmed.is_empty() {
            continue;
        }

        if trimmed.len() < 66 {
            bail!("invalid SHA256 manifest line {}: {trimmed}", index + 1);
        }

        let (hash, rest) = trimmed.split_at(64);
        if !hash.chars().all(|ch| ch.is_ascii_hexdigit())
            || rest.is_empty()
            || !rest.chars().next().is_some_and(char::is_whitespace)
        {
            bail!("invalid SHA256 manifest line {}: {trimmed}", index + 1);
        }

        let mut asset_name = rest.trim_start();
        if let Some(stripped) = asset_name.strip_prefix('*') {
            asset_name = stripped;
        }
        if asset_name.is_empty() {
            bail!("invalid SHA256 manifest line {}: {trimmed}", index + 1);
        }

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Regenerate the manifest with sha256sum (64 hex chars per line): sha256sum <assets> > SHA256SUMS
2. Check the reported line number in the message against the file to see the offending content
3. If you are a consumer, report the broken manifest for that release tag; do not bypass checksum verification
4. Ensure no tool rewraps or truncates the manifest before upload

Example fix

# before
1b0a9c...e2  codewhale-linux-x64.tar.gz   # 32-hex MD5, line < 66 chars

# after
9f2c86d1...full-64-hex...01  codewhale-linux-x64.tar.gz

// Validate a manifest before handing it to the updater:
fn manifest_lines_valid(text: &str) -> bool {
    text.lines().all(|line| {
        let t = line.trim();
        t.is_empty()
            || (t.len() >= 66
                && t.as_bytes()[..64].iter().all(|b| b.is_ascii_hexdigit())
                && t.as_bytes()[64].is_ascii_whitespace())
    })
}

Catch the parse error, use the printed 1-based line number to locate the bad entry, fix or regenerate the manifest, and re-run; never catch-and-ignore to download without checksums.

When it happens

Trigger: Self-update (or tests calling parse_checksum_manifest) where the downloaded checksum manifest contains MD5/CRC-style short hashes, truncated lines, or stray short text instead of sha256sum-format lines.

Common situations: Release pipelines that emit md5sums.txt by default, hand-written manifests, CI steps that truncate lines, or a proxy/HTML error page replacing the manifest body (though that more often trips the not-valid-UTF-8 or hex check).

Related errors

• {} from {} does not list {}; refusing to download an unverif
• unrecognised character {ch:?} in duration {s:?}
• SHA256 mismatch for {} from {}! expected: {expected} act
• no release source publishes an asset for this platform
• no release source published a usable {CHECKSUM_MANIFEST_ASSE

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/f8e32cc5baa6fb46. Report an issue: GitHub.