abiosoft/colima · error

no SHA entry found for '%s' in checksum file

Error message

no SHA entry found for '%s' in checksum file

What it means

The checksum file parsed without scanner errors, but no line's filename matched the artifact basename (the matcher accepts an exact basename or a '/basename' suffix). The digest for this artifact simply is not in that file; this frequently masks a 200-status HTML response or a naming/arch mismatch between the artifact URL and the checksum entry.

Source

Thrown at util/downloader/sha.go:143

	for scanner.Scan() {
		line := scanner.Text()
		// format: "<hash>  <filename>" (two spaces) or "<hash> *<filename>" (binary mode)
		parts := strings.Fields(line)
		if len(parts) >= 2 {
			hash := parts[0]
			filename := strings.TrimPrefix(parts[len(parts)-1], "*")

			if filename == targetFilename || strings.HasSuffix(filename, "/"+targetFilename) {
				return hash, nil
			}
		}
	}

	if err := scanner.Err(); err != nil {
		return "", err
	}

	return "", fmt.Errorf("no SHA entry found for '%s' in checksum file", targetFilename)
}

View on GitHub (pinned to c3a5f9184d)

Solutions

1. Fetch the checksum file and grep for the artifact basename to see the entries that do exist
2. Align the artifact URL or the sha URL so basenames match (watch arch/version suffixes)
3. Point SHA.URL at the checksum file of the exact release
4. If upstream genuinely has no entry for the artifact, remove SHA from the Request

Example fix

# before: sha file lists lima-0.0.1-amd64.qcow2 but the URL downloads lima-0.0.1-arm64.qcow2
# after: keep arch consistent between artifact and checksum source
curl -fsSL "$SHA_URL" | grep "$(basename "$ARTIFACT_URL")"

// pre-flight: confirm the checksum file references the artifact basename
resp, err := http.Get(shaURL)
if err != nil {
    return err
}
defer resp.Body.Close()
body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
if !strings.Contains(string(body), path.Base(artifactURL)) {
    return fmt.Errorf("checksum file %q has no entry for %s", shaURL, path.Base(artifactURL))
}

cacheFile, err := downloader.Download(host, req)
if err != nil && strings.Contains(err.Error(), "no SHA entry found") {
    // basenames drift between artifact and checksum file (arch/version suffixes)
    // curl -fsSL "$SHA_URL" | grep "$(basename "$ARTIFACT_URL")"
    // then fix req.URL / req.SHA, or drop req.SHA if upstream has no entry
    return err
}

When it happens

Trigger: Artifact URL basename (e.g. image-arm64.qcow2) has no matching entry — different arch suffix, renamed file, checksum file from another release; the 'checksum file' is actually an HTML page served with status 200.

Common situations: Mirror renames artifacts but keeps old checksums; arch-specific downloads against an amd64-only checksum list; captive portals returning 200 HTML.

Related errors

• error during image download: %w
• error validating SHA sum for '%s': %w
• error downloading SHA file from '%s': %w
• error parsing SHA file from '%s': %w
• error persisting runtime settings: %w

AI-assisted analysis of abiosoft/colima@c3a5f9184d (2026-08-15). Data as JSON: /api/errors/a829825db41475f3. Report an issue: GitHub.