{"record":{"id":"67a03158c1bb9d7a","repo":"coleam00/Archon","slug":"malformed-checksum-entry-for-filename-line","errorCode":null,"errorMessage":"Malformed checksum entry for ${filename}: \"${line.trim()}\"","messagePattern":"Malformed checksum entry for (.+?): \"(.+?)\"","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/cli/src/commands/serve.ts","lineNumber":301,"sourceCode":"  console.log(`Extracted to ${targetDir}`);\n}\n\nfunction cleanupAndThrow(tmpDir: string, message: string): never {\n  rmSync(tmpDir, { recursive: true, force: true });\n  throw new Error(message);\n}\n\n/**\n * Parse a SHA-256 checksum from a checksums.txt file (sha256sum format).\n * Format: `<hash>  <filename>` or `<hash> <filename>`\n */\nexport function parseChecksum(checksums: string, filename: string): string {\n  for (const line of checksums.split('\\n')) {\n    const parts = line.trim().split(/\\s+/);\n    if (parts.length >= 2 && parts[1] === filename) {\n      const hash = parts[0];\n      if (!/^[0-9a-f]{64}$/.test(hash)) {\n        throw new Error(`Malformed checksum entry for ${filename}: \"${line.trim()}\"`);\n      }\n      return hash;\n    }\n  }\n  throw new Error(`Checksum not found for ${filename} in checksums.txt`);\n}\n","sourceCodeStart":283,"sourceCodeEnd":308,"githubUrl":"https://github.com/coleam00/Archon/blob/0773b9745896ef0612e709c80845a0f7db315b19/packages/cli/src/commands/serve.ts#L283-L308","documentation":"parseChecksum scans a checksums.txt body for a line whose second whitespace-separated field equals the requested filename, then validates the first field is a 64-char lowercase hex sha256. If a matching line exists but its hash field is malformed, it throws this error naming the offending line. This guards against a tampered or corrupted checksums file producing a bogus expected hash.","triggerScenarios":"downloadWebDist -> parseChecksum(checksumsText, 'archon-web.tar.gz') finds a line whose second column matches the filename but whose first column fails /^[0-9a-f]{64}$/: checksums.txt fetched from the wrong URL (HTML error page with a coincidental match is unlikely; more likely a truncated or hand-edited file), an uppercase hash, a short/abbreviated hash, or a wrapped line.","commonSituations":"Manually edited checksums.txt; a proxy or script that mangled the file; a release tool emitting a different hash algorithm (e.g. md5) in the same file; copying an uppercase digest from a different generator.","solutions":["Inspect the quoted line in the message and correct the checksums.txt so the entry is `<64-hex>  archon-web.tar.gz` (lowercase sha256).","Re-download checksums.txt from the official release to replace a corrupted/mangled local copy.","Regenerate with `sha256sum archon-web.tar.gz > checksums.txt` if you built the artifact locally.","Confirm no proxy/AV is rewriting the downloaded text file before parsing."],"exampleFix":"// before (checksums.txt)\nABC123  archon-web.tar.gz   // uppercase short hash -> Malformed checksum entry\n// after\n9f2c...64-hex-lowercase...  archon-web.tar.gz","handlingStrategy":"validation","validationCode":"// Validate the manifest before passing it to parseChecksum\nconst line = checksumsText\n  .split('\\n')\n  .find((l) => l.trim().split(/\\s+/)[1] === 'archon-web.tar.gz');\nif (line && !/^[0-9a-f]{64}(\\s|$)/.test(line.trim())) {\n  throw new Error(`checksums.txt has a malformed sha256 for archon-web.tar.gz: \"${line.trim()}\" — refetch the official manifest`);\n}","typeGuard":"function isSha256Hex(value: string): value is `${string}` {\n  return /^[0-9a-f]{64}$/.test(value);\n}","tryCatchPattern":"try {\n  await serveCommand();\n} catch (err) {\n  if (err instanceof Error && err.message.startsWith('Malformed checksum entry')) {\n    // the offending line is quoted in the message; replace the local\n    // checksums.txt with the official release copy and retry.\n  } else throw err;\n}","preventionTips":["Never hand-edit checksums.txt; regenerate with sha256sum when building locally.","Fetch the manifest fresh from the release instead of caching copies.","Use lowercase hex sha256 digests; other tools may emit uppercase or non-sha256 hashes.","Keep one generator for the manifest so hash algorithm and format can't drift."],"tags":["checksum","validation","integrity","parsing"],"backgroundTag":"checksum-mismatch","analyzedSha":"0773b9745896ef0612e709c80845a0f7db315b19","analyzedAt":"2026-09-01T02:28:07.064Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}