{"record":{"id":"78cd73cd90552ecf","repo":"ipfs/kubo","slug":"invalid-hex-in-sha-512-checksum-w","errorCode":null,"errorMessage":"invalid hex in SHA-512 checksum: %w","messagePattern":"invalid hex in SHA-512 checksum: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/commands/update_github.go","lineNumber":261,"sourceCode":"\tif err != nil {\n\t\treturn fmt.Errorf(\"downloading checksum file: %w\", err)\n\t}\n\n\t// Parse \"<hex>  <filename>\\n\" format (standard sha512sum output).\n\tfields := strings.Fields(string(checksumData))\n\tif len(fields) < 1 {\n\t\treturn fmt.Errorf(\"empty or malformed .sha512 file\")\n\t}\n\twantHex := fields[0]\n\n\treturn verifySHA512(data, wantHex)\n}\n\n// verifySHA512 checks that data matches the given hex-encoded SHA-512 hash.\nfunc verifySHA512(data []byte, wantHex string) error {\n\twant, err := hex.DecodeString(wantHex)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid hex in SHA-512 checksum: %w\", err)\n\t}\n\tgot := sha512.Sum512(data)\n\tif !bytes.Equal(got[:], want) {\n\t\treturn fmt.Errorf(\"SHA-512 mismatch: expected %s, got %x\", wantHex, got[:])\n\t}\n\treturn nil\n}\n\n// assetNameForPlatformTag returns the expected archive filename for a given\n// release tag and the current GOOS/GOARCH.\nfunc assetNameForPlatformTag(tag string) string {\n\text := \"tar.gz\"\n\tif runtime.GOOS == \"windows\" {\n\t\text = \"zip\"\n\t}\n\treturn fmt.Sprintf(\"kubo_%s_%s-%s.%s\", tag, runtime.GOOS, runtime.GOARCH, ext)\n}\n","sourceCodeStart":243,"sourceCodeEnd":279,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/commands/update_github.go#L243-L279","documentation":"verifySHA512 validates that downloaded update-archive bytes match an expected hex-encoded SHA-512 digest. Before comparing, it hex-decodes the expected checksum string; if that string is not valid hexadecimal (odd length or non-hex characters), the decode fails and this error wraps the underlying hex error. It indicates a malformed checksum, not a content mismatch.","triggerScenarios":"Calling downloadAndVerifySHA512 (or verifySHA512 directly, e.g. from an anonymous helper) with a wantHex string that has odd length or contains characters outside 0-9a-fA-F, such as a truncated checksum, a checksum with a 'sha512:' prefix, or one copied with stray whitespace/characters.","commonSituations":"A release-metadata file or config pinned the checksum incorrectly; a checksum was copy-pasted from a page that prefixed it with the algorithm name; the checksum string was sliced/truncated during parsing or templating.","solutions":["Print and inspect wantHex; ensure it is a pure hex string of exactly 128 characters (64 bytes) with no prefix or whitespace","Trim surrounding whitespace and strip any 'sha512:'/'sha512-' prefix before passing it in","Verify the source of the checksum (release metadata file) was parsed correctly and not truncated","Fall back to re-fetching the checksum from the trusted release source"],"exampleFix":"// before\nverifySHA512(data, \"sha512:\" + checksumFromMeta)\n// after\nsum := strings.TrimPrefix(strings.TrimSpace(checksumFromMeta), \"sha512:\")\nif err := verifySHA512(data, sum); err != nil { ... }","handlingStrategy":"validation","validationCode":"sum := strings.TrimSpace(wantHex)\nif n := len(sum); n != 128 || strings.TrimLeft(sum, \"0123456789abcdefABCDEF\") != \"\" {\n    return fmt.Errorf(\"checksum must be 128 hex chars, got %d chars: %q\", n, sum)\n}\nerr := verifySHA512(data, sum)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Store checksums as raw 128-char hex, no algorithm prefix","Trim whitespace before passing checksums to verify functions","Keep checksum source (release metadata) and asset from the same release snapshot"],"tags":["checksum","validation","self-update"],"backgroundTag":"invalid-hex-checksum","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}