{"record":{"id":"0a85f3b7d44d8d16","repo":"golang/go","slug":"no-sha-256-hash-for-s-in-s","errorCode":null,"errorMessage":"no SHA-256 hash for %s in %s","messagePattern":"no SHA-256 hash for (.+?) in (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/go/internal/fips140/fips140.go","lineNumber":274,"sourceCode":"\t}\n\tname := filepath.Base(zipfile)\n\tvar want string\n\tfor line := range strings.SplitSeq(string(sums), \"\\n\") {\n\t\tline = strings.TrimSpace(line)\n\t\tif line == \"\" || strings.HasPrefix(line, \"#\") {\n\t\t\tcontinue\n\t\t}\n\t\tn, h, ok := strings.Cut(line, \" \")\n\t\tif !ok {\n\t\t\tcontinue\n\t\t}\n\t\tif n == name {\n\t\t\twant = strings.TrimSpace(h)\n\t\t\tbreak\n\t\t}\n\t}\n\tif want == \"\" {\n\t\treturn fmt.Errorf(\"no SHA-256 hash for %s in %s\", name, sumfile)\n\t}\n\tf, err := os.Open(zipfile)\n\tif err != nil {\n\t\treturn err\n\t}\n\tdefer f.Close()\n\th := sha256.New()\n\tif _, err := io.Copy(h, f); err != nil {\n\t\treturn err\n\t}\n\tif got := fmt.Sprintf(\"%x\", h.Sum(nil)); got != want {\n\t\treturn fmt.Errorf(\"SHA-256 hash of %s is %s, want %s (from %s)\", name, got, want, sumfile)\n\t}\n\treturn nil\n}\n\n// ResolveImport resolves the import path imp.\n// If it is of the form crypto/internal/fips140/foo","sourceCodeStart":256,"sourceCodeEnd":292,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/fips140/fips140.go#L256-L292","documentation":"Returned by verifyZipSum (FIPS 140 snapshot verification) when the fips140.sum file at GOROOT/lib/fips140/fips140.sum has no 'NAME HASH' entry whose NAME matches the basename of the FIPS zip being verified. The snapshot system cannot prove integrity without an expected hash.","triggerScenarios":"GOFIPS140 set to a snapshot version whose zip is present in the module cache but is not listed (or is listed under a different name) in GOROOT/lib/fips140/fips140.sum.","commonSituations":"Mixed Go toolchains where the toolchain's bundled fips140.sum does not know about the snapshot requested; manually added snapshot zips without updating the sum file; mismatched snapshot naming (e.g. case, suffix).","solutions":["Confirm the snapshot version in GOFIPS140 matches a Go toolchain whose fips140.sum lists it.","Reinstall/upgrade the Go toolchain so GOROOT/lib/fips140/fips140.sum is consistent with the bundled snapshots.","Inspect fips140.sum and verify the expected zip basename appears on a non-comment line.","Avoid mixing snapshot zips from a different toolchain version into this GOROOT's cache."],"exampleFix":"# before — snapshot zip not registered in the toolchain's sum file\n$ GOFIPS140=v1.2.3 go build ./...\nerror: no SHA-256 hash for fips140-v1.2.3.zip in .../fips140.sum\n# after — use a toolchain that ships that snapshot\n$ go1.99 toolchain ... && GOFIPS140=v1.2.3 go build ./...","handlingStrategy":"validation","validationCode":"// Ensure the requested snapshot version is listed in the toolchain's sum file\n// before running the build.\nfunc snapshotRegistered(sumfile, name string) bool {\n    b, err := os.ReadFile(sumfile)\n    if err != nil { return false }\n    for line := range strings.SplitSeq(string(b), \"\\n\") {\n        line = strings.TrimSpace(line)\n        if line == \"\" || strings.HasPrefix(line, \"#\") { continue }\n        if n, _, ok := strings.Cut(line, \" \"); ok && n == name { return true }\n    }\n    return false\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pin GOFIPS140 to a version bundled with the active toolchain.","Keep the toolchain and its bundled fips140.sum in sync — never mix versions.","Never manually add snapshot zips without updating the sum file."],"tags":["security","fips140","verification","toolchain","go-command"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}