{"record":{"id":"4f8906c45e23d9b1","repo":"pnpm/pnpm","slug":"node-integrity-hash-not-found","errorCode":"NODE_INTEGRITY_HASH_NOT_FOUND","errorMessage":"SHA-256 hash not found in SHASUMS256.txt for: ${fileName}","messagePattern":"SHA-256 hash not found in SHASUMS256\\.txt for: (.+?)","errorType":"exception","errorClass":"PnpmError","httpStatus":null,"severity":"error","filePath":"pnpm11/crypto/shasums-file/src/index.ts","lineNumber":139,"sourceCode":"): Promise<string> {\n  const res = await fetch(shasumsUrl)\n  if (!res.ok) {\n    throw new PnpmError(\n      'FAILED_DOWNLOAD_SHASUM_FILE',\n      `Failed to fetch integrity file: ${shasumsUrl} (status: ${res.status})`\n    )\n  }\n  const body = await res.text()\n  return body\n}\n\nconst SHA256_REGEX = /^[a-f0-9]{64}$/\n\nexport function pickFileChecksumFromShasumsFile (body: string, fileName: string): string {\n  const line = body.split('\\n').find(line => line.trim().endsWith(`  ${fileName}`))\n\n  if (!line) {\n    throw new PnpmError(\n      'NODE_INTEGRITY_HASH_NOT_FOUND',\n      `SHA-256 hash not found in SHASUMS256.txt for: ${fileName}`\n    )\n  }\n\n  const [sha256] = line.trim().split(/\\s+/)\n  if (!SHA256_REGEX.test(sha256)) {\n    throw new PnpmError(\n      'NODE_MALFORMED_INTEGRITY_HASH',\n      `Malformed SHA-256 for ${fileName}: ${sha256}`\n    )\n  }\n\n  const buffer = Buffer.from(sha256, 'hex')\n  const base64 = buffer.toString('base64')\n  return `sha256-${base64}`\n}\n","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/pnpm/pnpm/blob/5b11d3a15b9022a2109cb18ed96a5d652630371f/pnpm11/crypto/shasums-file/src/index.ts#L121-L157","documentation":"pickFileChecksumFromShasumsFile() scans SHASUMS256.txt lines for one whose trimmed form ends with exactly two spaces plus the file name, then extracts the SHA-256. If no line matches the requested artifact, NODE_INTEGRITY_HASH_NOT_FOUND is thrown: the checksum file does not describe that file name.","triggerScenarios":"Looking up 'node-v20.11.0-linux-armv7l.tar.xz' when that version ships no such artifact; a file name built with the wrong platform/arch token; the shasums body fetched from a different version URL than the artifact; a mirror serving a truncated or rewritten SHASUMS256.txt.","commonSituations":"Unsupported platform/arch combinations for the requested Node version (e.g. armv6l/no 32-bit builds on newer releases); bugs in caller-side artifact naming; version mismatch between mirror directories.","solutions":["Fetch the SHASUMS256.txt for that version and compare your exact file name against its lines","Fix the platform/arch mapping used to build the file name (match nodejs.org's official artifact naming)","Ensure the shasums URL and the artifact URL derive from the same version directory","Switch node-mirror to the official nodejs.org tree if a mirror mangles the file"],"exampleFix":"// before\nconst checksum = pickFileChecksumFromShasumsFile(body, `node-v${version}-${platform}-${arch}.tar.xz`)\n\n// after\nconst fileName = buildOfficialNodeArtifactName(version, platform, arch) // e.g. maps win32 -> win-x64\nconst checksum = pickFileChecksumFromShasumsFile(body, fileName)","handlingStrategy":"validation","validationCode":"const SHA_LINE = (fileName: string): RegExp => new RegExp(`\\\\s${escapeRegExp(fileName)}$`)\n\nfunction shasumsHasEntry (body: string, fileName: string): boolean {\n  return body.split('\\n').some(line => line.trim().endsWith(`  ${fileName}`))\n}\n\nif (!shasumsHasEntry(body, fileName)) {\n  throw new Error(`${fileName} is not listed in SHASUMS256.txt — check platform/version before extracting a checksum`)\n}","typeGuard":null,"tryCatchPattern":"try {\n  const integrity = pickFileChecksumFromShasumsFile(body, fileName)\n} catch (err) {\n  if ((err as PnpmError).code === 'NODE_INTEGRITY_HASH_NOT_FOUND') {\n    // surface the exact artifact name and the shasums source for diagnosis\n    throw new Error(`no checksum for artifact ${fileName}; verify it exists for this Node version/mirror`)\n  }\n  throw err\n}","preventionTips":["Derive artifact file names from nodejs.org's official naming (platform/arch mapping) instead of ad-hoc concatenation","Fetch SHASUMS256.txt from the same version directory as the artifact","Fail fast on unsupported platform/version combinations before attempting checksum lookup"],"tags":["node-runtime","checksum","validation","mirror"],"backgroundTag":null,"analyzedSha":"5b11d3a15b9022a2109cb18ed96a5d652630371f","analyzedAt":"2026-08-16T13:18:59.198Z","schemaVersion":2},"datasetVersion":"2026-08-16T18:17:16.020Z"}