{"record":{"id":"1fe1c22cc05f7ace","repo":"github/copilot-sdk","slug":"sha256sums-txt-does-not-contain-asset-name","errorCode":null,"errorMessage":"SHA256SUMS.txt does not contain {asset_name}.","messagePattern":"SHA256SUMS\\.txt does not contain (.+?)\\.","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"python/copilot/_cli_download.py","lineNumber":169,"sourceCode":"            checksums[filename.lstrip(\"*\")] = digest.lower()\n    return checksums\n\n\ndef _verify_checksum(data: bytes, expected_hash: str, filename: str) -> None:\n    \"\"\"Verify SHA-256 checksum of downloaded data.\"\"\"\n    actual = hashlib.sha256(data).hexdigest()\n    if actual != expected_hash:\n        raise RuntimeError(\n            f\"Checksum mismatch for {filename}:\\n  expected: {expected_hash}\\n  actual:   {actual}\"\n        )\n\n\ndef _fetch_verified_release_package(version: str, runtime_platform: str) -> bytes:\n    \"\"\"Download and verify the unified platform release package.\"\"\"\n    asset_name = get_release_asset_name(version, runtime_platform)\n    expected_hash = _fetch_checksums(version).get(asset_name)\n    if not expected_hash:\n        raise RuntimeError(f\"SHA256SUMS.txt does not contain {asset_name}.\")\n    url = get_download_url(version, asset_name)\n    data = _fetch_url_bytes(url, timeout=600)\n    _verify_checksum(data, expected_hash, asset_name)\n    return data\n\n\ndef _runtime_bundle_is_complete(pair_dir: Path, wrapper_name: str) -> bool:\n    required = (\n        pair_dir / wrapper_name,\n        pair_dir / \"runtime.node\",\n        pair_dir / _HOSTLESS_ASSETS_MARKER,\n    )\n    return all(path.is_file() and path.stat().st_size > 0 for path in required)\n\n\ndef download_cli(version: str | None = None, *, force: bool = False) -> str:\n    \"\"\"Provision a complete runtime bundle with a ``copilot[.exe]`` alias.\n","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/github/copilot-sdk/blob/cd8cf15dc3f9e762615790aaed0a771a0f392755/python/copilot/_cli_download.py#L151-L187","documentation":"_fetch_verified_release_package downloads a pinned Copilot release asset and verifies it against SHA256SUMS.txt before use. This error is raised when the fetched checksum manifest does not list the asset name computed for the requested version/platform, so verification cannot proceed.","triggerScenarios":"Calling ensure_runtime_wrapper/download_cli (or _fetch_verified_release_package directly) where get_release_asset_name(version, runtime_platform) produces an asset name absent from SHA256SUMS.txt — typically a version/platform mismatch or a manifest format change.","commonSituations":"Pinning a CLI_VERSION that was published before the unified platform package existed; a renamed or restructured release asset on GitHub; a partially published release where SHA256SUMS.txt was uploaded before the asset (or vice versa); a proxy serving a stale/cached checksum file.","solutions":["Verify the pinned version actually publishes the expected asset name (check get_release_asset_name output against the release's SHA256SUMS.txt).","Upgrade the SDK to a version whose asset naming matches the release's manifest.","Set COPILOT_CLI_PATH to an existing binary to bypass download entirely.","Clear any cached checksum files and retry in case a stale manifest was cached."],"exampleFix":"// before\nCLI_VERSION = \"0.1.0\"  # release predates unified package naming\n// after\nCLI_VERSION = \"0.2.1\"  # release whose SHA256SUMS.txt lists the computed asset name","handlingStrategy":"validation","validationCode":"from copilot._cli_download import get_release_asset_name, _fetch_checksums\nasset = get_release_asset_name(CLI_VERSION, get_runtime_platform())\nif asset not in _fetch_checksums(CLI_VERSION):\n    raise SystemExit(f\"release {CLI_VERSION} lacks asset {asset}; pin another version\")","typeGuard":null,"tryCatchPattern":"try:\n    wrapper = ensure_runtime_wrapper()\nexcept RuntimeError as e:\n    if \"does not contain\" in str(e):\n        wrapper = fallback_to_local_cli()  # COPILOT_CLI_PATH\n    else:\n        raise","preventionTips":["Pin versions known to publish the unified package and matching SHA256SUMS.txt.","Keep the SDK updated so asset naming logic matches current releases.","Bypass downloads in dev with COPILOT_CLI_PATH."],"tags":["network","download","checksum","release-assets"],"backgroundTag":"checksum-mismatch","analyzedSha":"cd8cf15dc3f9e762615790aaed0a771a0f392755","analyzedAt":"2026-09-09T18:32:31.973Z","contentChangedAt":"2026-09-09T18:32:31.973Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}