{"record":{"id":"05887b7c7f6709a1","repo":"zeroclaw-labs/zeroclaw","slug":"asset-asset-name-not-found-in-sha256sums","errorCode":null,"errorMessage":"asset '{asset_name}' not found in SHA256SUMS","messagePattern":"asset '(.+?)' not found in SHA256SUMS","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/commands/update.rs","lineNumber":578,"sourceCode":"        let Some(digest) = parts.next() else {\n            continue;\n        };\n        let Some(name) = parts.next() else {\n            continue;\n        };\n        let name = name.trim_start_matches('*');\n        if name == asset_name {\n            if parts.next().is_some() {\n                bail!(\"invalid SHA256SUMS entry for '{asset_name}'\");\n            }\n            if !is_sha256_hex(digest) {\n                bail!(\"invalid SHA256SUMS entry for '{asset_name}'\");\n            }\n            return Ok(digest);\n        }\n    }\n\n    bail!(\"asset '{asset_name}' not found in SHA256SUMS\")\n}\n\nfn is_sha256_hex(value: &str) -> bool {\n    value.len() == 64 && value.bytes().all(|b| b.is_ascii_hexdigit())\n}\n\nfn main_binary_name() -> &'static str {\n    if cfg!(windows) {\n        \"zeroclaw.exe\"\n    } else {\n        \"zeroclaw\"\n    }\n}\n\n/// Names of top-level *file* artifacts (not directories) the release archive is\n/// allowed to install next to the running binary, beyond the main `zeroclaw`\n/// executable itself. Anything else in the archive's top level is warned about\n/// and skipped — symmetric with how unknown top-level *directories* are","sourceCodeStart":560,"sourceCodeEnd":596,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/src/commands/update.rs#L560-L596","documentation":"During `zeroclaw update`, the updater derives the asset filename from the download URL's last path segment (asset_name_from_url) and searches every SHA256SUMS line for that exact name (after trimming a leading '*'). This error fires when no line in the manifest matches, so there is no expected digest to verify against and the update is aborted before install.","triggerScenarios":"Calling `zeroclaw update` when the release's SHA256SUMS lists different filenames than the uploaded assets: renamed asset (e.g. 'zeroclaw-x86_64-unknown-linux-gnu.tar.gz' in the manifest vs 'zeroclaw-x86_64-linux.tar.gz' uploaded), an asset added after the manifest was generated, case differences, or a manifest copied from a different release.","commonSituations":"Release tooling renames assets (adds/removes suffixes like .zip vs .tar.gz, musl vs gnu) without regenerating SHA256SUMS; partial republish of a release; zeroclaw version whose expected asset-name convention predates a naming change in newer releases.","solutions":["Compare the filename in the error with the filenames inside the target release's SHA256SUMS; the mismatch (suffix, prefix, case) is usually visible immediately.","If you publish releases: regenerate SHA256SUMS from the final uploaded asset set and re-publish.","If you run the updater: update to a zeroclaw version whose asset-naming convention matches the release layout, or install the asset manually from the release page.","Verify you are not mixing releases (e.g. pinned old SHA256SUMS URL with a new asset URL) if you drive the update flow programmatically."],"exampleFix":"# before: manifest names do not match uploaded assets\nabc...  zeroclaw-x86_64-unknown-linux-gnu.tar.gz\n# after: regenerate after upload so names match exactly\nsha256sum zeroclaw-x86_64-linux.tar.gz > SHA256SUMS","handlingStrategy":"validation","validationCode":"fn manifest_covers_asset(sums: &str, asset: &str) -> bool {\n    sums.lines().any(|l| {\n        l.split_whitespace()\n            .nth(1)\n            .map(|n| n.trim_start_matches('*') == asset)\n            .unwrap_or(false)\n    })\n}\n// before triggering the update, diff the manifest's filenames against the\n// release's actual asset list and fail fast with a clear message","typeGuard":null,"tryCatchPattern":"match run_update().await {\n    Err(e) if e.to_string().contains(\"not found in SHA256SUMS\") => {\n        // asset-name drift between release assets and manifest: surface the\n        // expected vs actual filename, keep the current binary installed\n    }\n    other => other,\n}","preventionTips":["Regenerate SHA256SUMS from the final uploaded asset set as the last release step, after any renaming.","Assert in CI that every uploaded asset filename appears exactly once in the manifest.","When changing asset naming conventions, bump and document the zeroclaw version that expects the new names."],"tags":["update","checksum","release-artifact","asset-name","manifest"],"backgroundTag":"checksum-verification-failed","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}