{"record":{"id":"49af2fa45cfb0328","repo":"Stirling-Tools/Stirling-PDF","slug":"no-pinned-gitleaks-checksum-for-key","errorCode":null,"errorMessage":"No pinned gitleaks checksum for {key}","messagePattern":"No pinned gitleaks checksum for (.+?)","errorType":"exception","errorClass":"SystemExit","httpStatus":null,"severity":"error","filePath":"scripts/pre-commit/install_gitleaks.py","lineNumber":76,"sourceCode":"\n\ndef cached_version() -> str | None:\n    if not BIN.exists():\n        return None\n    try:\n        return subprocess.run([str(BIN), \"version\"], capture_output=True, text=True).stdout.strip()\n    except OSError:\n        return None\n\n\ndef main() -> int:\n    if cached_version() == VERSION:\n        return 0\n\n    key = platform_key()\n    expected = SHA256.get(key)\n    if expected is None:\n        raise SystemExit(f\"No pinned gitleaks checksum for {key}\")\n\n    suffix = \"zip\" if key.startswith(\"windows\") else \"tar.gz\"\n    asset = f\"gitleaks_{VERSION}_{key}.{suffix}\"\n    url = f\"https://github.com/gitleaks/gitleaks/releases/download/v{VERSION}/{asset}\"\n    print(f\"Downloading gitleaks {VERSION} ({asset})\", flush=True)\n\n    BIN.parent.mkdir(parents=True, exist_ok=True)\n    archive, _ = urllib.request.urlretrieve(url)\n    digest = hashlib.sha256(Path(archive).read_bytes()).hexdigest()\n    if digest != expected:\n        raise SystemExit(f\"gitleaks checksum mismatch: expected {expected}, got {digest}\")\n\n    member = \"gitleaks.exe\" if IS_WINDOWS else \"gitleaks\"\n    if suffix == \"zip\":\n        with zipfile.ZipFile(archive) as zf:\n            data = zf.read(member)\n    else:\n        with tarfile.open(archive) as tf:","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/Stirling-Tools/Stirling-PDF/blob/9ef20dcab80b85041912f045e17a6aea1d08f969/scripts/pre-commit/install_gitleaks.py#L58-L94","documentation":"SystemExit raised by install_gitleaks.main when the computed platform key has no pinned SHA256 checksum in the SHA256 dict. The installer refuses to download and trust a binary whose checksum is not pinned — a supply-chain safety guard.","triggerScenarios":"The platform key (e.g. linux_arm64) is produced by platform_key() but is absent from the SHA256 pinning table, meaning the release was not vetted/pinned for that platform.","commonSituations":"A new gitleaks VERSION was bumped without updating the SHA256 table for all platforms. The platform is valid but the pin was never added.","solutions":["Add the correct SHA256 checksum for the platform key to the SHA256 dict (compute it from the official release asset).","Update VERSION and all pinned checksums together as a single change.","If the platform is unsupported, fall back to a manually installed gitleaks."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# Verify a pin exists before downloading\nif key not in SHA256:\n    raise SystemExit(f\"No pinned gitleaks checksum for {key}. Add it before installing.\")","typeGuard":null,"tryCatchPattern":null,"preventionTips":["When bumping VERSION, update all platform SHA256 pins together.","Compute checksums from the official release assets.","Never download without a pinned checksum."],"tags":["pre-commit","supply-chain","checksum","dependencies","python"],"backgroundTag":null,"analyzedSha":"9ef20dcab80b85041912f045e17a6aea1d08f969","analyzedAt":"2026-08-13T22:11:39.827Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}