{"record":{"id":"3d1c11aebba6b9b1","repo":"puppetlabs/puppet","slug":"unsupported-checksum-type-checksum-type","errorCode":null,"errorMessage":"Unsupported checksum type %{checksum_type}","messagePattern":"Unsupported checksum type %(.+?)","errorType":"validation","errorClass":"ArgumentError","httpStatus":null,"severity":"error","filePath":"lib/puppet/indirector/file_bucket_file/file.rb","lineNumber":209,"sourceCode":"            end\n          else\n            copy_bucket_file_to_contents_file(contents_file, bucket_file)\n          end\n\n          unless path_match(f, files_original_path)\n            f.seek(0, IO::SEEK_END)\n            f.puts(files_original_path)\n          end\n        end\n      end\n    end\n\n    def request_to_checksum_and_path(request)\n      checksum_type, checksum, path = request.key.split(%r{/}, 3)\n      if path == '' # Treat \"md5/<checksum>/\" like \"md5/<checksum>\"\n        path = nil\n      end\n      raise ArgumentError, _(\"Unsupported checksum type %{checksum_type}\") % { checksum_type: checksum_type.inspect } if checksum_type != Puppet[:digest_algorithm]\n\n      expected = method(checksum_type + \"_hex_length\").call\n      raise _(\"Invalid checksum %{checksum}\") % { checksum: checksum.inspect } if checksum !~ /^[0-9a-f]{#{expected}}$/\n\n      [checksum, path]\n    end\n\n    # @return [Object] Opaque path as constructed by the Puppet::FileSystem\n    #\n    def path_for(bucket_path, digest, subfile = nil)\n      bucket_path ||= Puppet[:bucketdir]\n\n      dir     = ::File.join(digest[0..7].split(\"\"))\n      basedir = ::File.join(bucket_path, dir, digest)\n\n      Puppet::FileSystem.pathname(subfile ? ::File.join(basedir, subfile) : basedir)\n    end\n","sourceCodeStart":191,"sourceCodeEnd":227,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/indirector/file_bucket_file/file.rb#L191-L227","documentation":"Every filebucket request key has the form 'algorithm/hexdigest' (optionally '/original/path'). request_to_checksum_and_path splits the key and hard-compares the algorithm token against the node's digest_algorithm setting; any other prefix raises ArgumentError 'Unsupported checksum type'. The digest must then be lowercase hex of the algorithm's exact length (md5 = 32 chars, sha256 = 64 chars), checked via <type>_hex_length.","triggerScenarios":"Sending a 'sha256/...' key to a node whose digest_algorithm is md5 (the classic default), or 'md5/...' to a node configured for sha256; Ruby callers hand-building request keys; agents and servers configured with different digest_algorithm values during a backup/restore.","commonSituations":"Fleets mid-migration from md5 to sha256; FIPS environments where md5 is unavailable; puppet.conf drift between agent and server; scripts hardcoding 'md5/' prefixes.","solutions":["Check the setting on the node making the request: puppet config print digest_algorithm, and use that algorithm in the key/URI prefix.","Standardize by setting digest_algorithm=sha256 in the [main] section of puppet.conf on every node (agents and servers) if you migrate off md5.","Fix hand-built keys to algorithm + '/' + lowercase hex digest of correct length.","Remember old backups written under md5 remain addressed with md5/ keys even after switching."],"exampleFix":"# before: node has digest_algorithm = md5\nPuppet::FileBucket::File.indirection.find('sha256/' + sha256_hex)\n# ArgumentError: Unsupported checksum type \"sha256\"\n\n# after: align algorithm on both sides\n# puppet.conf: [main] digest_algorithm = sha256\nPuppet::FileBucket::File.indirection.find('sha256/' + sha256_hex)","handlingStrategy":"validation","validationCode":"algo = Puppet[:digest_algorithm]\nhex = digest.downcase\nlen = { 'md5' => 32, 'sha256' => 64 }.fetch(algo)\nraise ArgumentError, 'wrong hex length for ' + algo unless hex =~ /\\A[0-9a-f]{#{len}}\\z/\nkey = algo + '/' + hex","typeGuard":"def valid_bucket_key?(key)\n  algo, hex = key.to_s.split('/', 2)\n  return false unless algo == Puppet[:digest_algorithm]\n  len = { 'md5' => 32, 'sha256' => 64 }.fetch(algo, 0)\n  hex.to_s =~ /\\A[0-9a-f]{#{len}}\\z/ ? true : false\nend","tryCatchPattern":null,"preventionTips":["Pin digest_algorithm explicitly in puppet.conf on all nodes; do not rely on defaults.","Build bucket keys from Puppet[:digest_algorithm]; never hardcode 'md5'.","Keep agent and server settings in sync during algorithm migrations."],"tags":["puppet","filebucket","checksum","configuration-mismatch","fips"],"backgroundTag":"checksum-algorithm-mismatch","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}