{"record":{"id":"074bbf39b0966f54","repo":"jdx/mise","slug":"source-archive-has-no-sha256-in-the-api","errorCode":null,"errorMessage":"{}: source archive has no sha256 in the API","messagePattern":"(.+?): source archive has no sha256 in the API","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/packages/brew/source.rs","lineNumber":75,"sourceCode":"        _ => \"source-only formula, no bottles\".to_string(),\n    }\n}\n\n/// Reject early what the source builder cannot handle, with the reason —\n/// checked before any work happens so dry-run and real runs fail alike.\npub(super) fn check_buildable(formula: &Formula) -> Result<()> {\n    let Some(src) = formula.stable_url() else {\n        bail!(\"{}: formula has no stable source URL\", formula.name);\n    };\n    if let Some(using) = &src.using {\n        bail!(\n            \"{}: source uses the {using:?} download strategy, which mise cannot build from \\\n             (and no bottle exists for this machine)\",\n            formula.name,\n        );\n    }\n    if src.checksum.is_none() {\n        bail!(\"{}: source archive has no sha256 in the API\", formula.name);\n    }\n    // the formula .rb must be pinned to the API snapshot's commit and\n    // verifiable — evaluating a newer/unverified formula against older\n    // source metadata would build the wrong thing\n    if formula.ruby_source_path.is_none() {\n        bail!(\"{}: API metadata has no ruby_source_path\", formula.name);\n    }\n    if formula.tap_git_head.is_none() {\n        bail!(\"{}: API metadata has no tap_git_head\", formula.name);\n    }\n    if formula\n        .ruby_source_checksum\n        .as_ref()\n        .and_then(|c| c.sha256.as_deref())\n        .is_none()\n    {\n        bail!(\"{}: API metadata has no formula checksum\", formula.name);\n    }","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/system/packages/brew/source.rs#L57-L93","documentation":"mise verifies source archives against the sha256 published in the Homebrew API before building. If the API metadata contains no checksum for the stable source, mise refuses to build because it cannot verify the download.","triggerScenarios":"`check_buildable` finds `src.checksum.is_none()` for a formula being built from source (no bottle available for the host).","commonSituations":"Formulas whose API JSON lacks a checksum (unusual metadata, very new or legacy entries); building on platforms that fall through to source for formulas that never publish source checksums.","solutions":["Prefer installing via bottle — use a supported platform or a formula version with bottles","Verify the API JSON actually has all_dependencies/source checksums; if not, this formula is not source-buildable via mise — use brew directly","Pick a different tool version that has a proper source checksum","File an issue with homebrew-core if the metadata is genuinely malformed"],"exampleFix":"null","handlingStrategy":"validation","validationCode":"curl -s https://formulae.brew.sh/api/formula/<name>.json | jq -e '.urls.stable.checksum' >/dev/null && echo ok || echo 'no source checksum'","typeGuard":null,"tryCatchPattern":"catch 'source archive has no sha256 in the API' => use a bottle-backed version/platform or install via brew directly","preventionTips":["Prefer formulas/versions with bottles for your platform","Refresh API metadata before installs","Avoid bleeding-edge formula versions that may lack source metadata","Record working tool versions in mise config for reproducibility"],"tags":["homebrew","checksum","build-from-source","verification"],"backgroundTag":"checksum-mismatch","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}