{"record":{"id":"074bbf39b0966f54","repo":"jdx/mise","slug":"source-archive-has-no-sha256-in-the-api","errorCode":null,"errorMessage":"{}: source archive has no sha256 in the API","messagePattern":"(.+?): source archive has no sha256 in the API","errorType":"validation","errorClass":"eyre::Report","httpStatus":null,"severity":"error","filePath":"src/system/packages/brew/source.rs","lineNumber":74,"sourceCode":"        _ => \"source-only formula, no bottles\".to_string(),\n    }\n}\n\n/// Reject early what the source builder cannot handle, with the reason —\n/// checked before any work happens so dry-run and real runs fail alike.\npub fn check_buildable(formula: &Formula) -> Result<()> {\n    let Some(src) = formula.stable_url() else {\n        bail!(\"{}: formula has no stable source URL\", formula.name);\n    };\n    if let Some(using) = &src.using {\n        bail!(\n            \"{}: source uses the {using:?} download strategy, which mise cannot build from \\\n             (and no bottle exists for this machine)\",\n            formula.name,\n        );\n    }\n    if src.checksum.is_none() {\n        bail!(\"{}: source archive has no sha256 in the API\", formula.name);\n    }\n    // the formula .rb must be pinned to the API snapshot's commit and\n    // verifiable — evaluating a newer/unverified formula against older\n    // source metadata would build the wrong thing\n    if formula.ruby_source_path.is_none() {\n        bail!(\"{}: API metadata has no ruby_source_path\", formula.name);\n    }\n    if formula.tap_git_head.is_none() {\n        bail!(\"{}: API metadata has no tap_git_head\", formula.name);\n    }\n    if formula\n        .ruby_source_checksum\n        .as_ref()\n        .and_then(|c| c.sha256.as_deref())\n        .is_none()\n    {\n        bail!(\"{}: API metadata has no formula checksum\", formula.name);\n    }","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/jdx/mise/blob/9dcfcaa0dc8747a2577d3270b69bb9d8313b2807/src/system/packages/brew/source.rs#L56-L92","documentation":"Before building from source, mise requires the source archive's sha256 from the Homebrew API so the download can be verified. If the API metadata carries no checksum for the stable source, the archive cannot be trusted and check_buildable rejects the build before any work happens.","triggerScenarios":"src.checksum.is_none() for a formula that fell back to source building because the host tag had no bottle.","commonSituations":"Stale or partially populated Homebrew API JSON cache; upstream metadata glitches right after a formula version bump; third-party taps with lax metadata.","solutions":["Clear mise's Homebrew API cache and retry to refresh the metadata","Update mise in case parsing of newer API shapes was fixed","Install via native brew, or wait until upstream metadata includes the checksum"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"match check_buildable(&formula) {\n    Err(e) if e.to_string().contains(\"no sha256\") => {\n        clear_homebrew_api_cache()?;    // refresh the API snapshot\n        check_buildable(&formula)        // metadata may now include the checksum\n    }\n    other => other,\n}","preventionTips":["Refresh the Homebrew API cache when metadata looks incomplete after upstream bumps","Do not bypass checksum verification — install with native brew if metadata stays incomplete","Update mise when new API metadata shapes appear"],"tags":["brew","source-build","checksum","metadata"],"backgroundTag":"missing-checksum-metadata","analyzedSha":"9dcfcaa0dc8747a2577d3270b69bb9d8313b2807","analyzedAt":"2026-08-17T14:28:50.624Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}