{"record":{"id":"0371a147a431b943","repo":"hashicorp/packer","slug":"failed-to-download-release-checksums-w","errorCode":null,"errorMessage":"failed to download release checksums: %w","messagePattern":"failed to download release checksums: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"provisioner/hcp-sbom/packer_release_fetch.go","lineNumber":251,"sourceCode":"\t\tzipURL := fmt.Sprintf(\"%s/packer/%s/%s\", base, v, fileName)\n\t\tshaSumsURL := fmt.Sprintf(\"%s/packer/%s/packer_%s_SHA256SUMS\", base, v, v)\n\n\t\tlog.Printf(\"[INFO] Downloading and verifying Packer %s for %s/%s...\", v, goos, goarch)\n\n\t\tcandidateZipPath, err := downloadURLToTempFile(ctx, client, zipURL, \".zip\")\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to download Packer release zip: %w\", err)\n\t\t}\n\t\tkeepCandidate := false\n\t\tdefer func() {\n\t\t\tif !keepCandidate {\n\t\t\t\t_ = os.Remove(candidateZipPath)\n\t\t\t}\n\t\t}()\n\n\t\tsumsContent, err := downloadChecksumFile(ctx, client, shaSumsURL)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to download release checksums: %w\", err)\n\t\t}\n\n\t\texpectedSHA, err := expectedZipSHA256FromSums(sumsContent, fileName)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to resolve expected checksum: %w\", err)\n\t\t}\n\n\t\tactualSHA, err := fileSHA256(candidateZipPath)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tif !strings.EqualFold(expectedSHA, actualSHA) {\n\t\t\treturn fmt.Errorf(\"checksum mismatch for %s: expected %s, got %s\", fileName, expectedSHA, actualSHA)\n\t\t}\n\n\t\t// Validate the expected binary exists inside the archive.\n\t\tbinaryName := \"packer\"","sourceCodeStart":233,"sourceCodeEnd":269,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/provisioner/hcp-sbom/packer_release_fetch.go#L233-L269","documentation":"Wrapped when downloadChecksumFile fails to fetch the packer_<v>_SHA256SUMS file. This includes request build errors, network errors, non-200 HTTP status, read errors, or an empty response body. Without the checksums file the downloaded zip cannot be verified, so the operation aborts (and is retried up to 3 times).","triggerScenarios":"downloadChecksumFile(ctx, client, shaSumsURL) errors: http.NewRequestWithContext fails, client.Do fails, HTTP status != 200 for packer_<v>_SHA256SUMS, io.ReadAll fails, or the body is empty/whitespace.","commonSituations":"Transient HTTP errors from releases.hashicorp.com right after a new version ships; network outage between zip download and checksum download; corporate proxy returning an empty body or block page; misconfigured release base URL.","solutions":["Re-run the build (retried automatically 3x); check status of releases.hashicorp.com for outages.","Curl the SHA256SUMS URL directly to see the raw HTTP status returned.","Fix proxy/firewall rules if the block page or empty body comes from an intermediary.","If persistent, pin/use a pre-downloaded Packer binary instead of the auto-download path."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"sumsURL := fmt.Sprintf(\"https://releases.hashicorp.com/packer/%s/packer_%s_SHA256SUMS\", v, v)\nresp, err := http.Get(sumsURL)\nif err != nil {\n\treturn err\n}\nbody, _ := io.ReadAll(resp.Body)\nresp.Body.Close()\nif resp.StatusCode != 200 || len(bytes.TrimSpace(body)) == 0 {\n\treturn fmt.Errorf(\"SHA256SUMS unavailable or empty (HTTP %d)\", resp.StatusCode)\n}","typeGuard":null,"tryCatchPattern":"if err := run(); err != nil {\n\tif strings.Contains(err.Error(), \"failed to download release checksums\") {\n\t\ttime.Sleep(30 * time.Second) // transient CDN blips usually clear\n\t\treturn run()\n\t}\n}","preventionTips":["Retry on checksum-file errors before escalating","Check HashiCorp release status when errors cluster around a new version","Bypass intercepting proxies that may strip/empty bodies","Pin a known-good Packer version if the latest release is flaky"],"tags":["network","http","checksum","download"],"backgroundTag":"artifact-download-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}