{"record":{"id":"0765f6a57d7cf778","repo":"oraios/serena","slug":"no-sha256-hash-found-for-self-url-please-updat","errorCode":null,"errorMessage":"No SHA256 hash found for {self._url}. Please update the hash database by running 'scripts/update_downloaded_dependency_hashes.py'.","messagePattern":"No SHA256 hash found for (.+?)\\. Please update the hash database by running 'scripts/update_downloaded_dependency_hashes\\.py'\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/solidlsp/dependency_provider.py","lineNumber":360,"sourceCode":"        self._verified = verified\n\n    def get_url(self) -> str:\n        return self._url\n\n    def download_to(self, target_path: str | PathLike) -> None:\n        \"\"\"\n        Downloads the dependency to the specified target path.\n        If defined at construction, will apply hash verification and archive extraction.\n\n        :param target_path: the path to which the dependency should be downloaded (or extracted if applicable)\n        \"\"\"\n        if not isinstance(target_path, str):\n            target_path = str(target_path)\n        if self._verified:\n            sha256 = DownloadedDependencyHashDatabase.get_instance().get_sha256(self)\n            if sha256 is None:\n                if is_running_in_ci():\n                    raise RuntimeError(\n                        f\"No SHA256 hash found for {self._url}. \"\n                        \"Please update the hash database by running 'scripts/update_downloaded_dependency_hashes.py'.\"\n                    )\n                log.warning(\"No SHA256 hash found for %s. The downloaded file will not be verified.\", self._url)\n        else:\n            sha256 = None\n        FileUtils.download_and_extract_archive_verified(\n            self._url, target_path, archive_type=self._archive_type, expected_sha256=sha256, allowed_hosts=self._allowed_hosts\n        )\n","sourceCodeStart":342,"sourceCodeEnd":370,"githubUrl":"https://github.com/oraios/serena/blob/7fcbca7e62555ec2287ddb2f083caee805848ea6/src/solidlsp/dependency_provider.py#L342-L370","documentation":"download_to verifies downloaded dependency artifacts against a local SHA256 hash database. In CI, when the URL has no recorded hash, it raises RuntimeError demanding the hash database be regenerated; locally it only logs a warning and downloads unverified.","triggerScenarios":"Calling download_to (via _setup_runtime_dependencies or _get_or_install_core_dependency) for a dependency whose URL is missing from the hash DB while is_running_in_ci() is true — typically a newly pinned/custom version or updated release URL.","commonSituations":"Pinning a new language-server version whose artifact URL changed; JetBrains/language-vendor release updates; running tests in CI with a custom version setting.","solutions":["Run `python scripts/update_downloaded_dependency_hashes.py` to add the new artifact hash, then retry.","If a custom version is intentional and local, unset CI markers or accept unverified download locally (warning only).","Report/pin back to a version whose artifact is present in the hash database."],"exampleFix":"// before\nci_job:\n  run: pytest test_dependencies.py\n// after\nci_job:\n  pre: python scripts/update_downloaded_dependency_hashes.py\n  run: pytest test_dependencies.py","handlingStrategy":"validation","validationCode":"from solidlsp.dependency_provider import DownloadedDependencyHashDatabase\n\ndef ensure_hash_known(download) -> bool:\n    if not download.is_verified:\n        return True\n    return DownloadedDependencyHashDatabase.get_instance().get_sha256(download) is not None","typeGuard":"def has_recorded_hash(download) -> bool:\n    return isinstance(download.url, str) and DownloadedDependencyHashDatabase.get_instance().get_sha256(download) is not None","tryCatchPattern":"try:\n    dep.download_to(target)\nexcept RuntimeError as e:\n    if 'No SHA256 hash found' in str(e):\n        subprocess.run(['python', 'scripts/update_downloaded_dependency_hashes.py'], check=True)\n        dep.download_to(target)\n    else:\n        raise","preventionTips":["Run scripts/update_downloaded_dependency_hashes.py as a CI pre-step whenever dependency versions are bumped.","Commit the updated hash database together with version-pinning changes.","Prefer versions whose artifact URLs already exist in the hash database."],"tags":["security","checksum","ci","dependency-management"],"backgroundTag":"checksum-missing","analyzedSha":"7fcbca7e62555ec2287ddb2f083caee805848ea6","analyzedAt":"2026-08-29T00:04:09.619Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}