{"record":{"id":"63d89bfb2c620765","repo":"hashicorp/packer","slug":"checksum-for-s-not-found-in-sha256sums","errorCode":null,"errorMessage":"checksum for %s not found in SHA256SUMS","messagePattern":"checksum for (.+?) not found in SHA256SUMS","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"provisioner/hcp-sbom/packer_release_fetch.go","lineNumber":195,"sourceCode":"\treturn err == nil\n}\n\nfunc expectedZipSHA256FromSums(sumsContent, fileName string) (string, error) {\n\tfor _, line := range strings.Split(sumsContent, \"\\n\") {\n\t\tfields := strings.Fields(strings.TrimSpace(line))\n\t\tif len(fields) < 2 {\n\t\t\tcontinue\n\t\t}\n\t\tcandidateFileName := strings.TrimPrefix(fields[len(fields)-1], \"*\")\n\t\tif candidateFileName == fileName {\n\t\t\thash := strings.ToLower(fields[0])\n\t\t\tif !isValidSHA256Hex(hash) {\n\t\t\t\treturn \"\", fmt.Errorf(\"invalid SHA256 checksum format for %s in SHA256SUMS\", fileName)\n\t\t\t}\n\t\t\treturn hash, nil\n\t\t}\n\t}\n\treturn \"\", fmt.Errorf(\"checksum for %s not found in SHA256SUMS\", fileName)\n}\n\nfunc fileSHA256(path string) (string, error) {\n\tf, err := os.Open(path)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to open %s for hashing: %w\", path, err)\n\t}\n\tdefer func() { _ = f.Close() }()\n\n\th := sha256.New()\n\tif _, err := io.Copy(h, f); err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed hashing %s: %w\", path, err)\n\t}\n\n\treturn hex.EncodeToString(h.Sum(nil)), nil\n}\n\n// downloadPackerRelease fetches the latest stable Packer version from the","sourceCodeStart":177,"sourceCodeEnd":213,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/provisioner/hcp-sbom/packer_release_fetch.go#L177-L213","documentation":"expectedZipSHA256FromSums scans every whitespace-separated line of the SHA256SUMS content for a line whose last field (with a leading '*' stripped for binary-mode digests) equals the target zip filename. If no line matches after scanning all lines, it throws this error meaning the checksum manifest does not contain an entry for the requested artifact.","triggerScenarios":"downloadPackerRelease builds fileName as packer_<v>_<goos>_<goarch>.zip and looks it up in packer_<v>_SHA256SUMS; the error fires when no line's filename matches — e.g. requesting a GOOS/GOARCH combination that has no published build (wrong os/arch), version mismatch between zip URL and checksums URL, or a partial/older SHA256SUMS file on a mirror.","commonSituations":"Running on an exotic GOOS/GOARCH (e.g. freebsd/riscv64) not covered by the release; typo'd or stale version string producing a checksums file that predates the build; internal mirror hosting trimmed checksum files; checksums file served for a different version than the zip.","solutions":["Print the resolved version and filename (packer_<v>_<goos>_<goarch>.zip) and check it appears in the SHA256SUMS file at releases.hashicorp.com/packer/<v>/packer_<v>_SHA256SUMS.","Verify runtime.GOOS/runtime.GOARCH maps to a build published in the release index (check the version entry's 'builds' array in index.json).","Ensure the zip download and SHA256SUMS URL use the same version — both are derived from the same v in downloadPackerRelease, so a custom getReleaseBaseURL override or mirror may be serving inconsistent content.","Update/republish the full SHA256SUMS on any internal mirror."],"exampleFix":"// before: requesting an unpublished platform\nzipPath, err := downloadPackerRelease(ctx, \"plan9\", \"amd64\")\n\n// after: gate on supported platforms\nif goos != \"linux\" && goos != \"darwin\" && goos != \"windows\" {\n    return \"\", fmt.Errorf(\"unsupported GOOS %q for Packer release download\", goos)\n}\nzipPath, err := downloadPackerRelease(ctx, goos, goarch)","handlingStrategy":"validation","validationCode":"supported := map[string]bool{\n    \"linux/amd64\": true, \"linux/arm64\": true, \"linux/386\": true,\n    \"darwin/amd64\": true, \"darwin/arm64\": true,\n    \"windows/amd64\": true, \"windows/386\": true,\n}\nif !supported[goos+\"/\"+goarch] {\n    return fmt.Errorf(\"no published Packer build for %s/%s\", goos, goarch)\n}","typeGuard":"func buildExistsInIndex(index releaseIndex, v, goos, goarch string) bool {\n    rv, ok := index.Versions[v]\n    if !ok {\n        return false\n    }\n    want := fmt.Sprintf(\"packer_%s_%s_%s.zip\", v, goos, goarch)\n    for _, b := range rv.Builds {\n        if b.Filename == want {\n            return true\n        }\n    }\n    return false\n}","tryCatchPattern":"expectedSHA, err := expectedZipSHA256FromSums(sumsContent, fileName)\nif err != nil {\n    if strings.Contains(err.Error(), \"not found in SHA256SUMS\") {\n        return fmt.Errorf(\"platform %s/%s has no checksum entry for Packer %s; check releases index builds\", goos, goarch, v)\n    }\n    return err\n}","preventionTips":["Cross-check runtime.GOOS/GOARCH against the release index 'builds' array before downloading.","Keep zip URL and SHA256SUMS URL derived from the same version string.","Mirror full, unmodified SHA256SUMS files.","Pin a known-good Packer version instead of always resolving latest if you need exotic platforms."],"tags":["checksum","sha256sums","release-artifacts","go"],"backgroundTag":"checksum-entry-not-found","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}