{"record":{"id":"1fab90868bd344c3","repo":"BoundaryML/baml","slug":"sdk-csharp-must-record-the-verified-nuget-package-digest","errorCode":null,"errorMessage":"sdk csharp must record the verified NuGet package digest","messagePattern":"sdk csharp must record the verified NuGet package digest","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"baml_language/crates/baml_release/src/manifest.rs","lineNumber":173,"sourceCode":"    }\n    validate_sha256(&artifact.sha256)?;\n    Ok(())\n}\n\nfn validate_sdk(language: &str, package: &SdkPackage) -> anyhow::Result<()> {\n    if package.registry.is_empty() || package.package.is_empty() || package.version.is_empty() {\n        anyhow::bail!(\"sdk {language} has an empty registry, package, or version\");\n    }\n    if let Some(digest) = &package.verified_package_sha256 {\n        validate_sha256(digest)\n            .map_err(|error| anyhow::anyhow!(\"sdk {language} package digest: {error}\"))?;\n    }\n    if language == \"csharp\" {\n        if package.registry != \"nuget\" || package.package != \"baml-bridge\" {\n            anyhow::bail!(\"sdk csharp must identify nuget/baml-bridge\");\n        }\n        if package.verified_package_sha256.is_none() {\n            anyhow::bail!(\"sdk csharp must record the verified NuGet package digest\");\n        }\n    }\n    if language == \"swift\" {\n        if package.registry != \"swiftpm\" || package.package != \"BoundaryML/baml-swift\" {\n            anyhow::bail!(\"sdk swift must identify swiftpm/BoundaryML/baml-swift\");\n        }\n        if package.verified_package_sha256.is_none() {\n            anyhow::bail!(\"sdk swift must record the verified XCFramework package digest\");\n        }\n    }\n    Ok(())\n}\n\n#[cfg(test)]\nmod tests {\n    use super::*;\n\n    fn full_target_artifacts() -> BTreeMap<String, Artifact> {","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/BoundaryML/baml/blob/bd85ce9dee1463ff04d27efd20531013a4ff46c1/baml_language/crates/baml_release/src/manifest.rs#L155-L191","documentation":"For the pinned C# SDK (nuget/baml-bridge), the manifest must also include verified_package_sha256 — the digest of the verified NuGet package. A csharp entry without this digest is rejected because supply-chain verification is mandatory for this SDK.","triggerScenarios":"validate_sdk() sees language == \"csharp\" with correct nuget/baml-bridge fields but verified_package_sha256 set to None (field absent or null).","commonSituations":"Adding the csharp SDK entry for the first time and skipping the digest; a generator that leaves the optional field unset; stripping 'optional' fields during a manifest cleanup.","solutions":["Compute the NuGet package's SHA-256 and set verified_package_sha256 for the csharp entry","If unsure of the digest, download the .nupkg from nuget.org and run sha256sum on it","Regenerate the manifest with the release tooling, which populates the digest automatically"],"exampleFix":"// before\n[sdk.csharp]\nregistry = \"nuget\"\npackage = \"baml-bridge\"\n\n// after\n[sdk.csharp]\nregistry = \"nuget\"\npackage = \"baml-bridge\"\nverified_package_sha256 = \"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\"","handlingStrategy":"validation","validationCode":"fn csharp_digest_present(p: &SdkPackage) -> bool {\n    p.verified_package_sha256.as_deref().map_or(false, |d| !d.is_empty())\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always record the NuGet package digest when adding a csharp SDK entry","Download the .nupkg and hash it before finalizing the manifest","Treat verified_package_sha256 as required for csharp, not optional"],"tags":["manifest","sdk","supply-chain","csharp"],"backgroundTag":"missing-required-config-field","analyzedSha":"bd85ce9dee1463ff04d27efd20531013a4ff46c1","analyzedAt":"2026-09-12T03:38:25.718Z","contentChangedAt":"2026-09-12T03:38:25.718Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}