Stirling-Tools/Stirling-PDF · error · SystemExit

No pinned gitleaks checksum for {key}

Error message

No pinned gitleaks checksum for {key}

What it means

SystemExit raised by install_gitleaks.main when the computed platform key has no pinned SHA256 checksum in the SHA256 dict. The installer refuses to download and trust a binary whose checksum is not pinned — a supply-chain safety guard.

Source

Thrown at scripts/pre-commit/install_gitleaks.py:76

def cached_version() -> str | None:
    if not BIN.exists():
        return None
    try:
        return subprocess.run([str(BIN), "version"], capture_output=True, text=True).stdout.strip()
    except OSError:
        return None


def main() -> int:
    if cached_version() == VERSION:
        return 0

    key = platform_key()
    expected = SHA256.get(key)
    if expected is None:
        raise SystemExit(f"No pinned gitleaks checksum for {key}")

    suffix = "zip" if key.startswith("windows") else "tar.gz"
    asset = f"gitleaks_{VERSION}_{key}.{suffix}"
    url = f"https://github.com/gitleaks/gitleaks/releases/download/v{VERSION}/{asset}"
    print(f"Downloading gitleaks {VERSION} ({asset})", flush=True)

    BIN.parent.mkdir(parents=True, exist_ok=True)
    archive, _ = urllib.request.urlretrieve(url)
    digest = hashlib.sha256(Path(archive).read_bytes()).hexdigest()
    if digest != expected:
        raise SystemExit(f"gitleaks checksum mismatch: expected {expected}, got {digest}")

    member = "gitleaks.exe" if IS_WINDOWS else "gitleaks"
    if suffix == "zip":
        with zipfile.ZipFile(archive) as zf:
            data = zf.read(member)
    else:
        with tarfile.open(archive) as tf:

View on GitHub (pinned to 9ef20dcab8)

Solutions

1. Add the correct SHA256 checksum for the platform key to the SHA256 dict (compute it from the official release asset).
2. Update VERSION and all pinned checksums together as a single change.
3. If the platform is unsupported, fall back to a manually installed gitleaks.

# Verify a pin exists before downloading
if key not in SHA256:
    raise SystemExit(f"No pinned gitleaks checksum for {key}. Add it before installing.")

When it happens

Trigger: The platform key (e.g. linux_arm64) is produced by platform_key() but is absent from the SHA256 pinning table, meaning the release was not vetted/pinned for that platform.

Common situations: A new gitleaks VERSION was bumped without updating the SHA256 table for all platforms. The platform is valid but the pin was never added.

Related errors

• gitleaks checksum mismatch: expected {expected}, got {digest
• Unsupported platform for gitleaks: {platform.system()}/{plat
• The 'tomlkit' library is not installed. Please install it us
• Command {' '.join(cmd)} failed: {result.stderr}
• File not found: {json_path}

AI-assisted analysis of Stirling-Tools/Stirling-PDF@9ef20dcab8 (2026-08-13). Data as JSON: /api/errors/49af2fa45cfb0328. Report an issue: GitHub.