{"record":{"id":"71d25357b958e061","repo":"gleam-lang/gleam","slug":"attempt-to-download-non-hex-package-from-hex","errorCode":null,"errorMessage":"Attempt to download non-hex package from hex","messagePattern":"Attempt to download non-hex package from hex","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"compiler-core/src/hex.rs","lineNumber":228,"sourceCode":"        Self {\n            fs_reader: DebugIgnore(fs_reader),\n            fs_writer: DebugIgnore(fs_writer),\n            http: DebugIgnore(http),\n            untar: DebugIgnore(untar),\n            hex_config: hexpm::Config::new(),\n            credentials: DebugIgnore(credentials),\n            paths,\n        }\n    }\n\n    pub async fn ensure_package_downloaded(\n        &self,\n        package: &ManifestPackage,\n    ) -> Result<bool, Error> {\n        let outer_checksum = match &package.source {\n            ManifestPackageSource::Hex { outer_checksum } => outer_checksum,\n            ManifestPackageSource::Git { .. } | ManifestPackageSource::Local { .. } => {\n                panic!(\"Attempt to download non-hex package from hex\")\n            }\n        };\n\n        let tarball_path = paths::global_package_cache_package_tarball(outer_checksum);\n        if self.fs_reader.is_file(&tarball_path) {\n            tracing::info!(\n                package = package.name.as_str(),\n                version = %package.version,\n                \"package_in_cache\"\n            );\n            return Ok(false);\n        }\n        tracing::info!(\n            package = &package.name.as_str(),\n            version = %package.version,\n            \"downloading_package_to_cache\"\n        );\n","sourceCodeStart":210,"sourceCodeEnd":246,"githubUrl":"https://github.com/gleam-lang/gleam/blob/15b07c783065c92bb016b1b74ed0995a5259850f/compiler-core/src/hex.rs#L210-L246","documentation":"Panic in `HexDownloader::download`/ensure_package_downloaded (compiler-core/src/hex.rs:228) when asked to download a manifest package whose source is not Hex (Git or Local). Only Hex packages have an outer checksum and a tarball in the Hex cache; requesting a download for a Git or Local dependency is a caller bug, so the compiler panics instead of returning an error.","triggerScenarios":"`ensure_package_in_build_directory` resolving a dependency whose `ManifestPackage.source` is `Git` or `Local` but routing it through the Hex download path — e.g. a manifest whose package origin changed (dependency switched from Hex to git/local in gleam.toml) without the manifest being updated, or stale cached manifest entries.","commonSituations":"Mixing hex and git/local dependencies and having an out-of-date manifest; editing gleam.toml to point a package at git while an old manifest still lists it as Hex (or vice versa); corrupted or hand-edited manifest.toml.","solutions":["Delete manifest.toml and re-run `gleam deps download` so the manifest is regenerated consistent with gleam.toml.","Ensure every dependency source in gleam.toml matches the manifest: run `gleam deps resolve` / any build command that re-syncs dependencies.","Check the manifest for Git/Local sourced packages that are being passed to Hex download; clear the stale build directory (`rm -rf build`).","If reproducible, file a bug — the caller should dispatch Git/Local packages to their own download paths rather than the Hex one."],"exampleFix":"// before: stale manifest marks a git dep as Hex source\n// manifest.toml: [packages] mydep -> source = \"hex\"\n// after: regenerate manifest after changing gleam.toml\n$ rm manifest.toml build -r && gleam deps download","handlingStrategy":"validation","validationCode":"// caller-side guard before hex download\nif !matches!(package.source, ManifestPackageSource::Hex { .. }) {\n    return Err(Error::UnsupportedPackageSource); // route git/local elsewhere\n}","typeGuard":"fn is_hex_package(p: &ManifestPackage) -> bool {\n    matches!(p.source, ManifestPackageSource::Hex { .. })\n}","tryCatchPattern":null,"preventionTips":["Keep manifest.toml in sync with gleam.toml sources; regenerate after changing dependency kinds","Never hand-edit manifest.toml source fields","Clear build/ and the manifest when switching a dep between hex and git"],"tags":["panic","hex","dependency-management","manifest","checksum"],"backgroundTag":"incompatible-source-type","analyzedSha":"15b07c783065c92bb016b1b74ed0995a5259850f","analyzedAt":"2026-09-14T11:14:59.388Z","contentChangedAt":"2026-09-14T11:14:59.388Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}