{"record":{"id":"74ffd21d3683ab0e","repo":"nikivdev/code","slug":"checksums-txt-does-not-contain-refusing-to-ins","errorCode":null,"errorMessage":"checksums.txt does not contain {}. Refusing to install.\nSet FLOW_UPGRADE_INSECURE=1 to bypass (not recommended).","messagePattern":"checksums\\.txt does not contain (.+?)\\. Refusing to install\\.\nSet FLOW_UPGRADE_INSECURE=1 to bypass \\(not recommended\\)\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/upgrade.rs","lineNumber":679,"sourceCode":"\n        if let Some(expected) = parse_sha256_from_checksums(&checksums, &tarball_asset.name) {\n            let actual = sha256_file(&temp_tarball)?;\n            if expected.to_lowercase() != actual.to_lowercase() {\n                bail!(\n                    \"checksum mismatch for {} (expected {}, got {})\",\n                    tarball_asset.name,\n                    expected,\n                    actual\n                );\n            }\n            println!(\"Checksum verified.\");\n        } else if insecure {\n            eprintln!(\n                \"Warning: checksums.txt does not contain {}; skipping checksum verification (FLOW_UPGRADE_INSECURE=1).\",\n                tarball_asset.name\n            );\n        } else {\n            bail!(\n                \"checksums.txt does not contain {}. Refusing to install.\\n\\\n                 Set FLOW_UPGRADE_INSECURE=1 to bypass (not recommended).\",\n                tarball_asset.name\n            );\n        }\n        let _ = fs::remove_file(&temp_checksums);\n    } else if insecure {\n        eprintln!(\n            \"Warning: checksums.txt not found in release assets; skipping checksum verification (FLOW_UPGRADE_INSECURE=1).\"\n        );\n    } else {\n        // Back-compat for older releases (e.g. v0.1.0) that don't ship checksums.txt.\n        eprintln!(\n            \"Warning: checksums.txt not found in release assets; skipping checksum verification.\"\n        );\n    }\n\n    // Extract and find the binary","sourceCodeStart":661,"sourceCodeEnd":697,"githubUrl":"https://github.com/nikivdev/code/blob/a747e741ae92c09071d0ae946ab48488adcff1ce/src/upgrade.rs#L661-L697","documentation":"In the upgrade `run` flow (src/upgrade.rs:~675), if the fetched checksums.txt has no entry for the tarball asset, checksum verification is impossible. Unless `FLOW_UPGRADE_INSECURE=1` is set, the upgrade bails rather than installing an unverifiable artifact.","triggerScenarios":"`parse_sha256_from_checksums(&checksums, &tarball_asset.name)` returns None and `insecure` is false — the asset filename is absent from checksums.txt (name changed, new asset added without checksums, or checksums.txt belongs to a different release).","commonSituations":"Upgrading a fork that publishes assets but forgot to regenerate checksums.txt; asset renamed (e.g. target triple changed) while checksums.txt still lists the old name; release automation skipped the checksum step.","solutions":["Verify the release is trustworthy, then temporarily bypass: `FLOW_UPGRADE_INSECURE=1 f upgrade` (at your own risk).","Compare the asset name in the release with lines in checksums.txt (`curl <checksums-url>`) to spot naming drift.","Update the fork/release pipeline to include the new asset in checksums.txt.","Pin to a previous release whose checksums are complete, or install via package manager."],"exampleFix":"// before\nf upgrade\n// after (only if you trust the release)\nFLOW_UPGRADE_INSECURE=1 f upgrade","handlingStrategy":"validation","validationCode":"# confirm the asset is listed before upgrading\ncurl -fsSL \"$CHECKSUMS_URL\" | grep -q -F \"$ASSET_NAME\" || echo \"asset missing from checksums.txt — refuse or set FLOW_UPGRADE_INSECURE=1\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check checksums.txt lists the exact asset filename before upgrading.","Never set FLOW_UPGRADE_INSECURE=1 in automation; fix the release instead.","Keep release CI generating checksums.txt for every asset, including renames.","When forking, regenerate checksums.txt after any asset changes."],"tags":["checksum","integrity","release-artifacts","upgrade"],"backgroundTag":"checksum-file-missing-entry","analyzedSha":"a747e741ae92c09071d0ae946ab48488adcff1ce","analyzedAt":"2026-09-01T22:43:55.719Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}