{"record":{"id":"748f11c7b39656ec","repo":"BoundaryML/baml","slug":"sdk-language-package-digest-error","errorCode":null,"errorMessage":"sdk {language} package digest: {error}","messagePattern":"sdk (.+?) package digest: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"baml_language/crates/baml_release/src/manifest.rs","lineNumber":166,"sourceCode":"    }\n    Ok(())\n}\n\nfn validate_artifact(name: &str, artifact: &Artifact) -> anyhow::Result<()> {\n    if !artifact.url.starts_with(\"https://\") {\n        anyhow::bail!(\"artifact {name} URL must use HTTPS\");\n    }\n    validate_sha256(&artifact.sha256)?;\n    Ok(())\n}\n\nfn validate_sdk(language: &str, package: &SdkPackage) -> anyhow::Result<()> {\n    if package.registry.is_empty() || package.package.is_empty() || package.version.is_empty() {\n        anyhow::bail!(\"sdk {language} has an empty registry, package, or version\");\n    }\n    if let Some(digest) = &package.verified_package_sha256 {\n        validate_sha256(digest)\n            .map_err(|error| anyhow::anyhow!(\"sdk {language} package digest: {error}\"))?;\n    }\n    if language == \"csharp\" {\n        if package.registry != \"nuget\" || package.package != \"baml-bridge\" {\n            anyhow::bail!(\"sdk csharp must identify nuget/baml-bridge\");\n        }\n        if package.verified_package_sha256.is_none() {\n            anyhow::bail!(\"sdk csharp must record the verified NuGet package digest\");\n        }\n    }\n    if language == \"swift\" {\n        if package.registry != \"swiftpm\" || package.package != \"BoundaryML/baml-swift\" {\n            anyhow::bail!(\"sdk swift must identify swiftpm/BoundaryML/baml-swift\");\n        }\n        if package.verified_package_sha256.is_none() {\n            anyhow::bail!(\"sdk swift must record the verified XCFramework package digest\");\n        }\n    }\n    Ok(())","sourceCodeStart":148,"sourceCodeEnd":184,"githubUrl":"https://github.com/BoundaryML/baml/blob/bd85ce9dee1463ff04d27efd20531013a4ff46c1/baml_language/crates/baml_release/src/manifest.rs#L148-L184","documentation":"If an SdkPackage provides an optional verified_package_sha256, it is checked with validate_sha256. When that check fails, the underlying error is wrapped with the language name so you know which SDK's digest is bad.","triggerScenarios":"validate_sdk() is given a manifest entry with a verified_package_sha256 that fails validate_sha256 — typically not a 64-char lowercase hex string, or a malformed/empty digest.","commonSituations":"Pasting a SHA-256 with 'sha256:' prefix or uppercase hex; truncating the digest; putting an md5 or sha1 hash in the field.","solutions":["Replace the digest with the correct 64-character lowercase hexadecimal SHA-256 of the package","Recompute it (e.g. sha256sum <package file>) and re-paste without prefixes or whitespace","If you cannot verify the digest yet, remove the verified_package_sha256 field (unless required, e.g. csharp/swift)"],"exampleFix":"// before\nverified_package_sha256 = \"SHA256:9F86D081884C7D65...\"\n\n// after\nverified_package_sha256 = \"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\"","handlingStrategy":"validation","validationCode":"fn is_valid_sha256(d: &str) -> bool {\n    d.len() == 64 && d.bytes().all(|b| b.is_ascii_hexdigit() && !b.is_ascii_uppercase())\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Paste digests as plain 64-char lowercase hex, no 'sha256:' prefix","Recompute digests from the actual package file rather than copying docs","Run sha256sum and copy its output verbatim"],"tags":["checksum","sha256","manifest"],"backgroundTag":"checksum-mismatch","analyzedSha":"bd85ce9dee1463ff04d27efd20531013a4ff46c1","analyzedAt":"2026-09-12T03:38:25.718Z","contentChangedAt":"2026-09-12T03:38:25.718Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}