{"record":{"id":"4712eeed117d7491","repo":"apple/pkl","slug":"unexpectedchecksuminpackageuri","errorCode":"unexpectedChecksumInPackageUri","errorMessage":"ErrorMessages.create(\"unexpectedChecksumInPackageUri\")","messagePattern":"ErrorMessages\\.create\\(\"unexpectedChecksumInPackageUri\"\\)","errorType":"error_code","errorClass":"URISyntaxException","httpStatus":null,"severity":"error","filePath":"pkl-core/src/main/java/org/pkl/core/packages/PackageUtils.java","lineNumber":38,"sourceCode":"import org.pkl.core.util.json.Json.FormatException;\nimport org.pkl.core.util.json.Json.JsonParseException;\n\npublic final class PackageUtils {\n  private PackageUtils() {}\n\n  public static PackageUri parsePackageUriWithoutChecksums(Object obj)\n      throws JsonParseException, URISyntaxException {\n    if (!(obj instanceof String string)) {\n      throw new FormatException(\"string\", obj.getClass());\n    }\n    var packageUri = new PackageUri(string);\n    checkHasNoChecksumComponent(packageUri);\n    return packageUri;\n  }\n\n  public static void checkHasNoChecksumComponent(PackageUri packageUri) throws URISyntaxException {\n    if (packageUri.getChecksums() != null) {\n      throw new URISyntaxException(\n          packageUri.toString(), ErrorMessages.create(\"unexpectedChecksumInPackageUri\"));\n    }\n  }\n}\n","sourceCodeStart":20,"sourceCodeEnd":43,"githubUrl":"https://github.com/apple/pkl/blob/f3efcbfc9b60d30053b0536d664948d7aa1b8673/pkl-core/src/main/java/org/pkl/core/packages/PackageUtils.java#L20-L43","documentation":"Thrown by PackageUtils.checkHasNoChecksumComponent when a parsed PackageUri still carries a checksums component. parsePackageUriWithoutChecksums is only for plain URIs; checksummed URIs (containing '::sha256:...') must go through the checksum-aware path.","triggerScenarios":"Calling parsePackageUriWithoutChecksums on a URI string like 'package://example.com/my-pkg@1.2.3::sha256:abc' — getChecksums() is non-null so the check throws.","commonSituations":"Mixing checksummed and unchecksummed dependency URIs in the same config; upgrading packages that gained checksums while code still uses the no-checksum parser; copy/pasting URIs that include the '::sha256:...' suffix.","solutions":["Strip the '::...' checksum suffix from the URI before parsing","Use the checksum-aware parsing API instead of parsePackageUriWithoutChecksums","Regenerate the dependency URI without checksums if your pipeline cannot verify them"],"exampleFix":"// before\nvar pkg = PackageUtils.parsePackageUriWithoutChecksums(\n    \"package://example.com/my-pkg@1.2.3::sha256:abc\");\n// after\nvar pkg = PackageUtils.parsePackageUriWithoutChecksums(\n    \"package://example.com/my-pkg@1.2.3\");","handlingStrategy":"validation","validationCode":"boolean hasNoChecksums(String uriStr) {\n  return !uriStr.contains(\"::\");\n}","typeGuard":null,"tryCatchPattern":"var pkgUri = new PackageUri(URI.create(uriStr));\nif (pkgUri.getChecksums() != null) {\n  throw new IllegalArgumentException(\"Unexpected checksum component in: \" + uriStr);\n}","preventionTips":["Strip the '::...' suffix before using no-checksum parsing","Use the checksum-aware API when URIs may include checksums","Check whether your dependencies publish checksummed URIs"],"tags":["pkl","package-uri","checksum","api-misuse"],"backgroundTag":"invalid-argument-value","analyzedSha":"f3efcbfc9b60d30053b0536d664948d7aa1b8673","analyzedAt":"2026-09-08T13:10:45.570Z","contentChangedAt":"2026-09-08T13:10:45.570Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}