{"record":{"id":"7b1672409e5a1ed1","repo":"gohugoio/hugo","slug":"unsupported-hash-algorithm-q-use-either-md5-sh","errorCode":null,"errorMessage":"unsupported hash algorithm: %q, use either md5, sha256, sha384 or sha512","messagePattern":"unsupported hash algorithm: %q, use either md5, sha256, sha384 or sha512","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"resources/resource_transformers/integrity/integrity.go","lineNumber":94,"sourceCode":"\t}\n\n\tctx.Data[\"Integrity\"] = integrity(t.algo, d)\n\tctx.AddOutPathIdentifier(\".\" + hex.EncodeToString(d[:]))\n\treturn nil\n}\n\nfunc newHash(algo string) (hash.Hash, error) {\n\tswitch algo {\n\tcase \"md5\":\n\t\treturn md5.New(), nil\n\tcase \"sha256\":\n\t\treturn sha256.New(), nil\n\tcase \"sha384\":\n\t\treturn sha512.New384(), nil\n\tcase \"sha512\":\n\t\treturn sha512.New(), nil\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported hash algorithm: %q, use either md5, sha256, sha384 or sha512\", algo)\n\t}\n}\n\n// Fingerprint applies fingerprinting of the given resource and hash algorithm.\n// It defaults to sha256 if none given, and the options are md5, sha256 or sha512.\n// The same algo is used for both the fingerprinting part (aka cache busting) and\n// the base64-encoded Subresource Integrity hash, so you will have to stay away from\n// md5 if you plan to use both.\n// See https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity\nfunc (c *Client) Fingerprint(res resources.ResourceTransformer, algo string) (resource.Resource, error) {\n\tif algo == \"\" {\n\t\talgo = defaultHashAlgo\n\t}\n\n\treturn res.Transform(&fingerprintTransformation{algo: algo})\n}\n\nfunc integrity(algo string, sum []byte) string {","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/gohugoio/hugo/blob/52c9bd7908b4d02d4d0ff8f82a888834d6ee10d2/resources/resource_transformers/integrity/integrity.go#L76-L112","documentation":"Returned by newHash when the algorithm string passed to Fingerprint/integrity is not one of the four supported values. Hugo's integrity transformer only supports md5, sha256, sha384, sha512; any other string (including typos or sha1) hits the default branch.","triggerScenarios":"Calling resources.Fingerprint res algo with algo set to an unsupported value, e.g. \"sha1\", \"SHA256\" (wrong case), \"sha-256\", or \"\" with a downstream override. Also reached by the | integrity template function when given a bad algorithm name.","commonSituations":"Passing 'sha1' for legacy compatibility, a casing mismatch, a hyphenated name from a different tool (sha-256), or an empty/undefined variable that resolves to a garbage string.","solutions":["Use one of the exact lowercase tokens: md5, sha256, sha384, or sha512.","If you omitted the algorithm intending the default, pass \"\" or nothing — Fingerprint defaults to sha256 when algo is empty.","Avoid md5 if you also rely on Subresource Integrity (SRI); prefer sha384 or sha512 for SRI-compatible output."],"exampleFix":"// before\n{{ $fp := $r | fingerprint \"sha1\" }}\n\n// after\n{{ $fp := $r | fingerprint \"sha256\" }}","handlingStrategy":"validation","validationCode":"var supportedHash = map[string]bool{\"md5\": true, \"sha256\": true, \"sha384\": true, \"sha512\": true}\n\nfunc validHashAlgo(a string) bool { return supportedHash[a] }","typeGuard":"// Go guard narrowing to a supported algorithm.\nfunc normalizeAlgo(a string) (string, bool) {\n    allowed := []string{\"md5\", \"sha256\", \"sha384\", \"sha512\"}\n    for _, s := range allowed { if s == a { return s, true } }\n    return \"\", false\n}","tryCatchPattern":null,"preventionTips":["Always pass one of the four lowercase exact tokens.","Default to \"\" (sha256) when you don't need a specific algorithm.","Validate user/template input against the allow-list before calling Fingerprint."],"tags":["integrity","fingerprint","hash","validation"],"backgroundTag":null,"analyzedSha":"52c9bd7908b4d02d4d0ff8f82a888834d6ee10d2","analyzedAt":"2026-08-09T21:49:36.660Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}