{"record":{"id":"0ea49495563ff707","repo":"ipfs/kubo","slug":"empty-or-malformed-sha512-file","errorCode":null,"errorMessage":"empty or malformed .sha512 file","messagePattern":"empty or malformed \\.sha512 file","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/commands/update_github.go","lineNumber":250,"sourceCode":"\tif int64(len(data)) > maxDownloadSize {\n\t\treturn nil, fmt.Errorf(\"download exceeds maximum size of %d bytes\", maxDownloadSize)\n\t}\n\treturn data, nil\n}\n\n// downloadAndVerifySHA512 downloads the .sha512 sidecar file for the given\n// archive URL and verifies the archive data against it.\nfunc downloadAndVerifySHA512(ctx context.Context, data []byte, archiveURL string) error {\n\tsha512URL := archiveURL + \".sha512\"\n\tchecksumData, err := downloadAsset(ctx, sha512URL)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"downloading checksum file: %w\", err)\n\t}\n\n\t// Parse \"<hex>  <filename>\\n\" format (standard sha512sum output).\n\tfields := strings.Fields(string(checksumData))\n\tif len(fields) < 1 {\n\t\treturn fmt.Errorf(\"empty or malformed .sha512 file\")\n\t}\n\twantHex := fields[0]\n\n\treturn verifySHA512(data, wantHex)\n}\n\n// verifySHA512 checks that data matches the given hex-encoded SHA-512 hash.\nfunc verifySHA512(data []byte, wantHex string) error {\n\twant, err := hex.DecodeString(wantHex)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid hex in SHA-512 checksum: %w\", err)\n\t}\n\tgot := sha512.Sum512(data)\n\tif !bytes.Equal(got[:], want) {\n\t\treturn fmt.Errorf(\"SHA-512 mismatch: expected %s, got %x\", wantHex, got[:])\n\t}\n\treturn nil\n}","sourceCodeStart":232,"sourceCodeEnd":268,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/commands/update_github.go#L232-L268","documentation":"downloadAndVerifySHA512 parses the .sha512 sidecar expecting standard sha512sum format (`<hex>  <filename>`). If the downloaded checksum content has no fields at all — an empty body or pure whitespace — the parser cannot extract the expected hash and throws this error.","triggerScenarios":"The .sha512 URL returns HTTP 200 with an empty or whitespace-only body: a proxy/interception layer returned a blank 200, GitHub served a zero-byte object, or the sidecar was uploaded empty.","commonSituations":"Captive portals or middleboxes returning empty 200 responses; a corrupted upload in the release; misbehaving proxies that silently replace content with empty bodies while keeping status 200.","solutions":["Retry from a different network to rule out proxy interception","Inspect the sidecar manually: `curl -s <archive-url>.sha512` — it must contain a hex digest and filename","If the published .sha512 file is genuinely empty, report the broken release artifact to kubo maintainers","Download the archive and checksum manually and verify with `sha512sum -c` as a workaround"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// sanity-check the sidecar content before trusting the updater\nbody, err := fetch(archiveURL + \".sha512\")\nif err != nil {\n\treturn err\n}\nfields := strings.Fields(string(body))\nif len(fields) < 1 || len(fields[0]) != 128 {\n\treturn fmt.Errorf(\"checksum sidecar empty or not sha512 hex — network/proxy interference suspected\")\n}","typeGuard":null,"tryCatchPattern":"if err := runUpdate(); err != nil {\n\tif strings.Contains(err.Error(), \"empty or malformed .sha512\") {\n\t\t// compare with the published checksum manually\n\t\tlog.Print(\"verify manually: curl -s <archive>.sha512 | sha512sum -c\")\n\t}\n\treturn err\n}","preventionTips":["Rule out empty-200 middleboxes: curl the .sha512 URL and confirm a 128-char hex digest is returned","Avoid networks with TLS-intercepting proxies that can blank response bodies","If the published sidecar is truly empty, report the broken release artifact upstream rather than bypassing verification","Never skip checksum verification as a workaround; verify manually instead"],"tags":["checksum","sha512","validation","github"],"backgroundTag":"malformed-checksum-file","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}