{"record":{"id":"7f321183a7da8d9a","repo":"hashicorp/nomad","slug":"unsupported-checksum-format","errorCode":null,"errorMessage":"unsupported checksum format","messagePattern":"unsupported checksum format","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"api/ioutil.go","lineNumber":54,"sourceCode":"// The digest must be in the format \"<algo>=<base64 of hash>\" (e.g. \"sha-256=gPelGB7...\").\n//\n// When the reader is fully consumed (i.e. EOT is encountered), if the checksum don't match,\n// `Read` returns a checksum mismatch error.\nfunc newChecksumValidatingReader(r io.ReadCloser, digest string) (io.ReadCloser, error) {\n\tparts := strings.SplitN(digest, \"=\", 2)\n\tif len(parts) != 2 {\n\t\treturn nil, errors.New(\"invalid digest format\")\n\t}\n\n\talgo := parts[0]\n\tvar hash hash.Hash\n\tswitch algo {\n\tcase \"sha-256\":\n\t\thash = sha256.New()\n\tcase \"sha-512\":\n\t\thash = sha512.New()\n\tdefault:\n\t\treturn nil, errors.New(\"unsupported checksum format\")\n\t}\n\n\treturn &checksumValidatingReader{\n\t\tr:        r,\n\t\talgo:     algo,\n\t\tchecksum: parts[1],\n\t\thash:     hash,\n\t}, nil\n}\n\nfunc (r *checksumValidatingReader) Read(b []byte) (int, error) {\n\tn, err := r.r.Read(b)\n\tif n != 0 {\n\t\tr.hash.Write(b[:n])\n\t}\n\n\tif err == io.EOF || err == io.ErrClosedPipe {\n\t\tfound := base64.StdEncoding.EncodeToString(r.hash.Sum(nil))","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/api/ioutil.go#L36-L72","documentation":"Returned by newChecksumValidatingReader in api/ioutil.go when the digest's algorithm part (before '=') is not 'sha-256' or 'sha-512'. The library only implements those two hash algorithms for checksum-validated reads.","triggerScenarios":"Passing a digest like 'md5=...', 'sha1=...', 'sha-256' with different casing ('SHA-256=...'), or any other algorithm prefix to Snapshot / newChecksumValidatingReader.","commonSituations":"Servers that emit md5 or crc32c digests; RFC 3230 allows the server to choose the algorithm, so a non-HashiCorp-compatible server or proxy can advertise an unsupported algo; case differences after header normalization.","solutions":["Check the algorithm prefix of the digest; it must be exactly 'sha-256' or 'sha-512' (case-sensitive)","Configure the server/proxy to emit sha-256 or sha-512 digests","Request a supported digest via the 'Want-Digest' header if the server supports content negotiation","If an unsupported algorithm is unavoidable, disable checksum validation or implement a client-side validator"],"exampleFix":"// before\n// server sends: Digest: md5=xyz...\nr, err := newChecksumValidatingReader(body, digest)\n// after\n// configure server/proxy to send: Digest: sha-256=...\ndigest := resp.Header.Get(\"Digest\")\nif !strings.HasPrefix(digest, \"sha-256=\") && !strings.HasPrefix(digest, \"sha-512=\") {\n    return errors.New(\"server sent unsupported digest algorithm: \" + digest)\n}\nr, err := newChecksumValidatingReader(body, digest)","handlingStrategy":"validation","validationCode":"func digestAlgoSupported(digest string) bool {\n    algo := strings.SplitN(digest, \"=\", 2)[0]\n    return algo == \"sha-256\" || algo == \"sha-512\"\n}","typeGuard":null,"tryCatchPattern":"r, err := newChecksumValidatingReader(body, digest)\nif err != nil && strings.Contains(err.Error(), \"unsupported checksum\") {\n    return fmt.Errorf(\"server sent digest with unsupported algorithm: %q\", digest)\n}","preventionTips":["Configure servers/proxies to emit sha-256 or sha-512 digests only","Use the Want-Digest header for content negotiation","Check algorithm casing: the switch is exact ('sha-256', not 'SHA-256')","Document supported algorithms in your tooling"],"tags":["go","checksum","unsupported-algorithm","http"],"backgroundTag":"unsupported-checksum-algorithm","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}