{"record":{"id":"51064115672b668a","repo":"github/copilot-sdk","slug":"clihash-must-be-a-sha-256-hash-d-bytes-got-d","errorCode":null,"errorMessage":"CliHash must be a SHA-256 hash (%d bytes), got %d bytes","messagePattern":"CliHash must be a SHA-256 hash \\((.+?) bytes\\), got (.+?) bytes","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"go/internal/embeddedcli/embeddedcli.go","lineNumber":70,"sourceCode":"\tLinuxMuslRuntimeLib            io.Reader\n\tLinuxMuslRuntimeLibHash        []byte\n\tLinuxMuslRuntimeExecutable     io.Reader\n\tLinuxMuslRuntimeExecutableHash []byte\n\tLinuxMuslRuntimeNode           io.Reader\n\tLinuxMuslRuntimeNodeHash       []byte\n\tLinuxMuslRuntimeAssets         io.Reader\n\tLinuxMuslRuntimeAssetsHash     []byte\n\n\tDir     string\n\tVersion string\n}\n\nfunc Setup(cfg Config) {\n\tif cfg.Cli == nil {\n\t\tpanic(\"Cli reader is required\")\n\t}\n\tif len(cfg.CliHash) != sha256.Size {\n\t\tpanic(fmt.Sprintf(\"CliHash must be a SHA-256 hash (%d bytes), got %d bytes\", sha256.Size, len(cfg.CliHash)))\n\t}\n\tif cfg.LinuxMuslCli != nil && len(cfg.LinuxMuslCliHash) != sha256.Size {\n\t\tpanic(fmt.Sprintf(\"LinuxMuslCliHash must be a SHA-256 hash (%d bytes), got %d bytes\", sha256.Size, len(cfg.LinuxMuslCliHash)))\n\t}\n\tif cfg.LinuxMuslRuntimeLib != nil && len(cfg.LinuxMuslRuntimeLibHash) != sha256.Size {\n\t\tpanic(fmt.Sprintf(\"LinuxMuslRuntimeLibHash must be a SHA-256 hash (%d bytes), got %d bytes\", sha256.Size, len(cfg.LinuxMuslRuntimeLibHash)))\n\t}\n\tvalidateRuntimePairConfig(cfg.RuntimeExecutable, cfg.RuntimeExecutableHash, cfg.RuntimeNode, cfg.RuntimeNodeHash, \"\")\n\tvalidateRuntimePairConfig(cfg.LinuxMuslRuntimeExecutable, cfg.LinuxMuslRuntimeExecutableHash, cfg.LinuxMuslRuntimeNode, cfg.LinuxMuslRuntimeNodeHash, \"LinuxMusl\")\n\tvalidateOptionalHash(cfg.RuntimeAssets, cfg.RuntimeAssetsHash, \"RuntimeAssetsHash\")\n\tvalidateOptionalHash(cfg.LinuxMuslRuntimeAssets, cfg.LinuxMuslRuntimeAssetsHash, \"LinuxMuslRuntimeAssetsHash\")\n\tsetupMu.Lock()\n\tdefer setupMu.Unlock()\n\tif setupDone {\n\t\tpanic(\"Setup must only be called once\")\n\t}\n\tif pathInitialized {\n\t\tpanic(\"Setup must be called before Path is accessed\")","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/github/copilot-sdk/blob/cd8cf15dc3f9e762615790aaed0a771a0f392755/go/internal/embeddedcli/embeddedcli.go#L52-L88","documentation":"embeddedcli.Setup requires CliHash to be exactly sha256.Size (32) bytes. If the provided hash has any other length, Setup panics. The hash is used to verify the embedded CLI binary's integrity at install time, so a wrong-length value means the checksum cannot be a valid SHA-256.","triggerScenarios":"Calling Setup with Config.CliHash set to a hex string (64 bytes... actually 64 chars/64 bytes if raw string), an empty slice, a truncated hash, or a SHA-1/MD5 digest of the wrong size.","commonSituations":"Passing hex-encoded hash strings instead of raw digest bytes (use hex.DecodeString first), copying hashes between fields of different assets, or generating the hash with the wrong algorithm.","solutions":["Decode a hex-encoded digest with hex.DecodeString before assigning CliHash","Compute the hash with sha256.Sum256 so the slice is exactly 32 bytes","Confirm you are passing the hash of the same bytes supplied as Cli","Add a pre-call check: len(cliHash) != sha256.Size"],"exampleFix":"// before\nhashHex := \"abc123...\" // 64-char hex string\nSetup(Config{Cli: r, CliHash: []byte(hashHex)})\n// after\nraw, _ := hex.DecodeString(hashHex)\nSetup(Config{Cli: r, CliHash: raw})","handlingStrategy":"validation","validationCode":"if len(cliHash) != sha256.Size {\n\treturn fmt.Errorf(\"CliHash must be %d bytes, got %d\", sha256.Size, len(cliHash))\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Produce hashes with sha256.Sum256, never raw hex text","hex.DecodeString any hex digest before use","Name variables to make byte-vs-hex explicit (cliHashBytes)","Add unit tests asserting all embedded hashes are 32 bytes"],"tags":["go","sha256","config","panic"],"backgroundTag":"invalid-argument-value","analyzedSha":"cd8cf15dc3f9e762615790aaed0a771a0f392755","analyzedAt":"2026-09-09T18:32:31.973Z","contentChangedAt":"2026-09-09T18:32:31.973Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}