JuliusBrussee/caveman · error

signed checksum manifest does not contain ${artifact}

Error message

signed checksum manifest does not contain ${artifact}

What it means

expectedDigest() scanned every well-formed line of the signature-verified checksums.txt and none matched the requested artifact name ('<name>_<os>_<arch>', for example caveman-mcp_linux_arm64). The manifest is valid but incomplete for this platform — there is nothing safe to verify the download against, so the install stops.

Source

Thrown at packages/shared/binary-installer/installer.mjs:124

    return verify(
      "sha256",
      Buffer.from(checksums),
      createPublicKey(BINARY_SIGNING_PUBKEY),
      Buffer.from(bundle.messageSignature.signature, "base64"),
    );
  } catch {
    return false;
  }
}

function expectedDigest(checksums, artifact) {
  for (const line of checksums.split("\n")) {
    if (!line) continue;
    const match = line.match(/^([a-f0-9]{64})  ([A-Za-z0-9._-]+)$/);
    if (!match) throw new Error("signed checksum manifest is malformed");
    if (match[2] === artifact) return match[1];
  }
  throw new Error(`signed checksum manifest does not contain ${artifact}`);
}

function cleanup(path) {
  try {
    unlinkSync(path);
  } catch (error) {
    if (error.code !== "ENOENT") throw error;
  }
}

async function download(url, part, timeout) {
  const response = await asset(url, timeout);
  if (!response.body) throw new Error("binary download failed: response body missing");
  const hash = createHash("sha256");
  const file = await open(part, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600);
  const reader = response.body.getReader();
  try {
    while (true) {

View on GitHub (pinned to 27d5a3981a)

Solutions

1. Check the release's checksums.txt for your platform's artifact name to confirm the gap, then run on a platform the release covers
2. Install the binary for your platform by another route and point the env var at it (CAVEMAN_MCP_BIN / CAVEMAN_SHRINK_BIN / CAVEMAN_BROWSE_BIN)
3. Report the missing artifact upstream so the release publishes all six supported pairs

Example fix

# before: release lacks caveman-mcp_linux_arm64
#   signed checksum manifest does not contain caveman-mcp_linux_arm64

# after: self-supply the binary
export CAVEMAN_MCP_BIN=/opt/caveman/bin/caveman-mcp   # built or downloaded for arm64

// before setup: confirm this release ships your platform's artifact
const txt = await (await fetch(`${release}/checksums.txt`)).text();
if (!txt.split("\n").some((l) => l.endsWith(` ${name}_${process.platform}_${arch}`))) {
  process.env[envVar] = "/path/to/self-supplied-binary"; // avoid the missing-artifact install path
}

function manifestCovers(manifest, artifact) {
  return manifest.split("\n").some((l) => l.endsWith(`  ${artifact}`));
}

try { await ensureBinary({ name, envVar }); }
catch (e) {
  if (/does not contain/.test(String(e?.message)) && process.env[envVar]) return process.env[envVar];
  throw e;
}

When it happens

Trigger: A release published with artifacts for only some platforms (for example linux/amd64 and darwin/arm64 present, linux/arm64 absent) while running on the missing one; a name mismatch between the locally computed artifact string and the release pipeline's file naming.

Common situations: Partial release uploads; custom mirrors syncing only the platforms the mirror owner uses; release scripts with per-platform build failures that still publish checksums for the succeeded subset.

Related errors

• no prebuilt binary for ${os}/${arch} — supported: darwin/arm
• signed checksum manifest is malformed
• signature check failed for ${artifact} — partial download de
• caveman-code: host command shell is not available
• cave_sandbox_os_network_isolation_unavailable

AI-assisted analysis of JuliusBrussee/caveman@27d5a3981a (2026-08-15). Data as JSON: /api/errors/fb0c3af2c953a2ff. Report an issue: GitHub.