{"record":{"id":"31b53fc21da91d94","repo":"NousResearch/hermes-agent","slug":"no-checksum-entry-for-asset-name-in-checksum-fi","errorCode":null,"errorMessage":"No checksum entry for {asset_name} in {checksum_file.name}","messagePattern":"No checksum entry for (.+?) in (.+?)","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"agent/proxy_sources/iron_proxy.py","lineNumber":640,"sourceCode":"        # A present signature that does NOT verify is a tamper signal — fail hard.\n        raise RuntimeError(\n            \"iron-proxy checksums.txt failed GPG signature verification — \"\n            \"refusing to install (possible release-channel tampering). \"\n            f\"gpg: {verify.stderr.decode('utf-8', 'replace')[:300]}\"\n        )\n    logger.info(\"Verified iron-proxy checksums.txt GPG signature.\")\n    return True\n\n\ndef _expected_sha256(checksum_file: Path, asset_name: str) -> str:\n    \"\"\"Parse the standard ``sha256sum`` output: ``<hex>  <filename>``.\"\"\"\n\n    text = checksum_file.read_text(encoding=\"utf-8\", errors=\"replace\")\n    for line in text.splitlines():\n        parts = line.strip().split()\n        if len(parts) >= 2 and parts[-1] == asset_name:\n            return parts[0]\n    raise RuntimeError(\n        f\"No checksum entry for {asset_name} in {checksum_file.name}\"\n    )\n\n\ndef _sha256_file(path: Path) -> str:\n    h = hashlib.sha256()\n    with open(path, \"rb\") as f:\n        for chunk in iter(lambda: f.read(65536), b\"\"):\n            h.update(chunk)\n    return h.hexdigest()\n\n\ndef _pick_tar_member(tf: tarfile.TarFile, binary_name: str) -> tarfile.TarInfo:\n    \"\"\"Find the binary inside the upstream tar.\n\n    iron-proxy's archive is typically flat (binary at root) but we tolerate\n    a top-level directory.  Members must be regular files with a leaf name\n    matching ``binary_name``, no absolute paths, and no ``..`` traversal.","sourceCodeStart":622,"sourceCodeEnd":658,"githubUrl":"https://github.com/NousResearch/hermes-agent/blob/c896c09c42910c584c4c7d2325b58c14713ea42c/agent/proxy_sources/iron_proxy.py#L622-L658","documentation":"After downloading checksums.txt, the installer parses standard `sha256sum` output (`<hex>  <filename>`) and looks for a line whose last field equals the computed asset name. If no line matches, it refuses to proceed — there is no unsigned path. This almost always means the release's asset naming scheme and the locally computed asset name have drifted.","triggerScenarios":"find_iron_proxy(install_if_missing=True) when _platform_asset_name() produces a name like iron-proxy_vX_linux_arm64.tar.gz but the release names assets differently (e.g. dropped the arch suffix, switched to .zip, or renamed to iron-proxy-linux-arm64.tar.gz). Also triggered by checksums.txt using different path prefixes per line.","commonSituations":"Upgrading iron-proxy upstream changed asset naming between versions while _IRON_PROXY_VERSION was bumped; running on an arch whose asset the release doesn't publish (e.g. linux armv7) so its entry simply isn't in checksums.txt.","solutions":["Open the release page for _IRON_PROXY_VERSION and compare the published asset filenames against what the error's asset_name implies; align the naming in _platform_asset_name (or the version pin) with the actual release.","If your arch genuinely has no asset, install the binary manually on a supported host or build from source and place it where find_iron_proxy() looks.","Downgrade/pin to the last release whose checksums.txt contains your asset name until the module is updated."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"import urllib.request, json\n\ndef asset_in_release(api_url: str, asset_name: str) -> bool:\n    with urllib.request.urlopen(api_url, timeout=15) as r:\n        assets = [a[\"name\"] for a in json.load(r).get(\"assets\", [])]\n    return asset_name in assets","typeGuard":null,"tryCatchPattern":"try:\n    find_iron_proxy(install_if_missing=True)\nexcept RuntimeError as e:\n    if \"No checksum entry\" in str(e):\n        # version pin / asset naming drift — update pin or install manually\n        raise","preventionTips":["After bumping _IRON_PROXY_VERSION, run a canary `hermes egress install` in CI to catch asset-naming drift before users do.","Pre-install binaries in machine images so naming drift never hits runtime paths."],"tags":["release-assets","install","iron-proxy"],"backgroundTag":null,"analyzedSha":"c896c09c42910c584c4c7d2325b58c14713ea42c","analyzedAt":"2026-08-14T17:18:01.089Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}