{"record":{"id":"271172b0df2caaf6","repo":"apple/pkl","slug":"unknownchecksumalgorithm","errorCode":"unknownChecksumAlgorithm","errorMessage":"ErrorMessages.create(\"unknownChecksumAlgorithm\", algorithm)","messagePattern":"ErrorMessages\\.create\\(\"unknownChecksumAlgorithm\", algorithm\\)","errorType":"error_code","errorClass":"URISyntaxException","httpStatus":null,"severity":"error","filePath":"pkl-core/src/main/java/org/pkl/core/packages/PackageUri.java","lineNumber":200,"sourceCode":"\n  public String getPathWithoutVersion() {\n    return pathWithoutVersion;\n  }\n\n  public @Nullable Checksums getChecksums() {\n    return checksums;\n  }\n\n  private Checksums parseChecksumPart(String checksumPart) throws URISyntaxException {\n    var parts = checksumPart.split(\":\");\n    if (parts.length != 2) {\n      throw new URISyntaxException(\n          uri.toString(), ErrorMessages.create(\"invalidPackageUriChecksum\", checksumPart));\n    }\n    var algorithm = parts[0];\n    var checksum = parts[1];\n    if (!algorithm.equals(\"sha256\")) {\n      throw new URISyntaxException(\n          uri.toString(), ErrorMessages.create(\"unknownChecksumAlgorithm\", algorithm));\n    }\n    return new Checksums(checksum);\n  }\n}\n","sourceCodeStart":182,"sourceCodeEnd":206,"githubUrl":"https://github.com/apple/pkl/blob/f3efcbfc9b60d30053b0536d664948d7aa1b8673/pkl-core/src/main/java/org/pkl/core/packages/PackageUri.java#L182-L206","documentation":"Validation in PackageUri.parseChecksumPart: the checksum segment of a package URI may only use the sha256 algorithm; any other algorithm name (the first part before ':') is rejected with URISyntaxException. The input at fault is a checksum part like `md5:...` in the package URI's checksum component.","triggerScenarios":"A package URI checksum suffix uses another algorithm name, e.g. '::sha512:abc...' or '::md5:abc...' — the equals(\"sha256\") check fails.","commonSituations":"Writing a URI using a different hash algorithm than the tooling produced; hand-crafting checksummed URIs; migrating from tools that default to sha512/md5.","solutions":["Use a sha256 checksum in the package URI: `sha256:<hex>`.","Drop the checksum component if no sha256 digest is available."],"exampleFix":"// before\nvar uri = \"package://example.com/my-pkg@1.2.3::sha512:abc...\";\n// after\nvar uri = \"package://example.com/my-pkg@1.2.3::sha256:def658...\";","handlingStrategy":"validation","validationCode":"boolean usesSha256(String uriStr) {\n  int idx = uriStr.indexOf(\"::\");\n  if (idx == -1) return true;\n  var part = uriStr.substring(idx + 2);\n  String[] pieces = part.split(\":\");\n  return pieces.length == 2 && \"sha256\".equals(pieces[0]);\n}","typeGuard":null,"tryCatchPattern":"try {\n  var pkg = new PackageUri(URI.create(uriStr));\n} catch (URISyntaxException e) {\n  throw new IllegalArgumentException(\"Only sha256 checksums are supported: \" + uriStr, e);\n}","preventionTips":["Only use sha-256 when computing package checksums","Don't hand-write algorithm names in package URIs","Use URIs as emitted by the Pkl tooling"],"tags":["pkl","package-uri","checksum","sha256"],"backgroundTag":"checksum-mismatch","analyzedSha":"f3efcbfc9b60d30053b0536d664948d7aa1b8673","analyzedAt":"2026-09-08T13:10:45.570Z","contentChangedAt":"2026-09-08T13:10:45.570Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}