{"record":{"id":"085a90d558fcc73a","repo":"denoland/deno","slug":"cli-laufey-sums-lock-has-no-pinned-laufey-version","errorCode":null,"errorMessage":"cli/laufey_sums.lock has no pinned laufey version — populate it for v{laufey_version} before building","messagePattern":"cli/laufey_sums\\.lock has no pinned laufey version — populate it for v(.+?) before building","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"cli/build.rs","lineNumber":355,"sourceCode":"      continue;\n    };\n    let Some(version) = rest.trim().strip_prefix(\"version:\") else {\n      continue;\n    };\n    let pinned = version.trim().trim_start_matches('v');\n    if !pinned.is_empty() {\n      return Some(pinned.to_string());\n    }\n  }\n  None\n}\n\n/// Confirm `cli/laufey_sums.lock` targets `laufey_version`. The lock file carries a\n/// `# version: vX.Y.Z` directive that must match the `laufey` crate version\n/// the binary is built against; a mismatch means the pinned digests are stale.\nfn check_laufey_pinned_sums_version(manifest_dir: &str, laufey_version: &str) {\n  let Some(pinned) = laufey_version_from_sums(manifest_dir) else {\n    panic!(\n      \"cli/laufey_sums.lock has no pinned laufey version — populate it for \\\n       v{laufey_version} before building\"\n    );\n  };\n  if pinned != laufey_version {\n    panic!(\n      \"cli/laufey_sums.lock pins Laufey v{pinned} but this build expects \\\n       v{laufey_version} — refresh the lock file from the upstream SHA256SUMS\"\n    );\n  }\n}\n\n/// SHA-256 digests of the vendored AppImage Type-2 runtime stubs (from\n/// `cli/tools/appimage_runtime/README.md`). Verified at build time so a\n/// silent local modification (or a bad rebase) of those checked-in binaries\n/// can't slip into a release build undetected.\nconst APPIMAGE_RUNTIME_HASHES: &[(&str, &str)] = &[\n  (","sourceCodeStart":337,"sourceCodeEnd":373,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/cli/build.rs#L337-L373","documentation":"The Deno CLI build script resolves the laufey crate version from the workspace Cargo.lock and cross-checks cli/laufey_sums.lock — the SHA256SUMS trust anchor for desktop backend downloads — so a stale digest file becomes a compile error instead of a first-launch failure (emit_laufey_version, cli/build.rs:275-299). When laufey_version_from_sums finds no '# version:' directive in the lock file, check_laufey_pinned_sums_version (build.rs:341-350) panics with this message at build time.","triggerScenarios":"Building after creating/renaming cli/laufey_sums.lock without a '# version: X.Y.Z' header line; a lock file truncated during merge-conflict resolution; lock files rewritten by tools or editors that strip comment lines.","commonSituations":"First build after the laufey integration on a new checkout; merge conflicts resolved by taking one side and losing the header comment; hand-assembled lock files during vendoring work.","solutions":["Open cli/laufey_sums.lock and add a header line '# version: <X.Y.Z>' where <X.Y.Z> is the laufey version pinned in ../Cargo.lock (grep -A1 'name = \"laufey\"' Cargo.lock).","Prefer regenerating the whole lock from the upstream SHA256SUMS of that release so the directive and digests agree.","Keep the directive as the first line and configure tooling to preserve comments."],"exampleFix":"# before (cli/laufey_sums.lock — no header)\n3f9a1b...  laufey-linux-x86_64.tar.gz\n\n# after\n# version: 0.1.4\n3f9a1b...  laufey-linux-x86_64.tar.gz","handlingStrategy":"validation","validationCode":"# preflight: the lock file must carry a version directive matching Cargo.lock\nhead -1 cli/laufey_sums.lock | grep -q '^# version: ' \\\n  || echo 'cli/laufey_sums.lock: missing # version: directive'\ngrep -A1 'name = \"laufey\"' Cargo.lock | grep version","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep '# version: X.Y.Z' as the first line of cli/laufey_sums.lock","Teach merge tooling to preserve comment lines in lock files","After creating or rewriting the lock, run a cargo check — the build script fails fast"],"tags":["deno","build","cargo","build-script","lockfile","laufey"],"backgroundTag":"stale-lockfile","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}