{"record":{"id":"6d5540ffea0fb1ab","repo":"Hmbown/CodeWhale","slug":"from-does-not-list-refusing-to-download","errorCode":null,"errorMessage":"{} from {} does not list {}; refusing to download an unverified update","messagePattern":"(.+?) from (.+?) does not list (.+?); refusing to download an unverified update","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/cli/src/update.rs","lineNumber":855,"sourceCode":"        download_url(&checksum_asset.browser_download_url, proxy).with_context(|| {\n            format!(\n                \"failed to download {} from {}\\n{}\",\n                checksum_asset.name,\n                fetched.source.describe(),\n                update_network_fallback_hint()\n            )\n        })?;\n    let checksum_text = std::str::from_utf8(&checksum_bytes)\n        .with_context(|| format!(\"{} is not valid UTF-8\", checksum_asset.name))?;\n    let checksums = parse_checksum_manifest(checksum_text).with_context(|| {\n        format!(\n            \"failed to parse {} from {}\",\n            checksum_asset.name,\n            fetched.source.describe()\n        )\n    })?;\n    if !checksums.contains_key(&asset.name) {\n        bail!(\n            \"{} from {} does not list {}; refusing to download an unverified update\",\n            checksum_asset.name,\n            fetched.source.describe(),\n            asset.name\n        );\n    }\n\n    Ok(DownloadPlan {\n        source: fetched.source.clone(),\n        binary_name: asset.name.clone(),\n        binary_url: asset.browser_download_url.clone(),\n        checksums,\n    })\n}\n\nfn manifest_probe_fetcher(proxy: Option<&Proxy>) -> Arc<ManifestFetcher> {\n    let proxy = proxy.cloned();\n    Arc::new(move |candidate: &ReleaseSourceCandidate| {","sourceCodeStart":837,"sourceCodeEnd":873,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/cli/src/update.rs#L837-L873","documentation":"While building the download plan, the release's checksum manifest asset (e.g. SHA256SUMS) downloaded and parsed correctly, but contains no entry keyed by this platform's binary asset name. Because the updater refuses to download any update it cannot checksum-verify, it aborts here.","triggerScenarios":"Self-update (or a programmatic call into the update-planning path) for a release whose checksum manifest is missing the asset line, or where the asset name in the manifest does not exactly match the release asset name (suffix, casing, .tar.gz vs raw).","commonSituations":"A release published with regenerated/renamed assets but a stale checksum manifest, hand-edited manifests with typos, or a partially published release.","solutions":["Report the affected release tag to the maintainers so the checksum manifest is republished","Update to a different version whose manifest lists the asset correctly","If you publish these releases yourself, regenerate the manifest from the exact shipped asset names (sha256sum over the final filenames) and re-upload","Verify the asset name in the message against the release's file list to spot naming mismatches"],"exampleFix":"# before: SHA256SUMS lists a differently named asset\n9f2c...01  codewhale-linux-arm64.gz\n\n# after: name matches the release asset exactly\n9f2c...01  codewhale-linux-arm64.tar.gz","handlingStrategy":"validation","validationCode":"// Before relying on self-update for a release, verify its manifest covers your asset:\nfn manifest_covers_asset(manifest_text: &str, asset_name: &str) -> bool {\n    manifest_text\n        .lines()\n        .any(|l| l.trim().split_whitespace().nth(1)\n            .map(|n| n.trim_start_matches('*')) == Some(asset_name))\n}\n\n// e.g. fetch SHA256SUMS for the tag, then:\nassert!(manifest_covers_asset(&text, \"codewhale-linux-arm64.tar.gz\"));","typeGuard":null,"tryCatchPattern":"Catch the refusal, surface the asset name and source from the message, and direct users to pin a known-good version or wait for a republished manifest; do not offer to skip checksum verification.","preventionTips":["When publishing releases, generate the checksum manifest from the final asset filenames in the same CI job","Verify a new release tag by dry-running the updater before announcing it","Keep asset naming stable across releases"],"tags":["release","checksums","sha256","self-update"],"backgroundTag":"checksum-manifest-missing-entry","analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}