{"record":{"id":"851b508fe0ae7ebd","repo":"denoland/deno","slug":"no-pinned-sha-256-for-archive-in-cli-laufey-sums","errorCode":null,"errorMessage":"no pinned SHA-256 for {archive} in cli/laufey_sums.lock (regenerate when bumping LAUFEY_VERSION to v{LAUFEY_VERSION}; laufey v{LAUFEY_VERSION} release may not include backend '{backend}' for target '{target}')","messagePattern":"no pinned SHA-256 for (.+?) in cli/laufey_sums\\.lock \\(regenerate when bumping LAUFEY_VERSION to v(.+?); laufey v(.+?) release may not include backend '(.+?)' for target '(.+?)'\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/tools/desktop.rs","lineNumber":1927,"sourceCode":"    target: &str,\n  ) -> Result<PathBuf, AnyError> {\n    let dir = self.backend_cache_dir(backend, target);\n    let marker = dir.join(\".downloaded\");\n    if marker.exists() {\n      return Ok(dir);\n    }\n\n    let archive = laufey_archive_name(backend, target);\n    let client = self.http_client_provider.get_or_create()?;\n\n    // Use the in-tree pinned digests rather than fetching SHA256SUMS from the\n    // release page. The latter is unsigned, so trusting it would let anyone\n    // who can write to the laufey release host swap both archive and sums\n    // together (TOFU). The lock file is reviewed in PRs when LAUFEY_VERSION\n    // bumps, so this is the trust anchor. That the lock file's pinned version\n    // matches LAUFEY_VERSION is asserted at build time (see cli/build.rs).\n    let expected = parse_sha256sum(LAUFEY_PINNED_SUMS, &archive).ok_or_else(|| {\n      deno_core::anyhow::anyhow!(\n        \"no pinned SHA-256 for {archive} in cli/laufey_sums.lock \\\n         (regenerate when bumping LAUFEY_VERSION to v{LAUFEY_VERSION}; \\\n         laufey v{LAUFEY_VERSION} release may not include backend '{backend}' for target '{target}')\"\n      )\n    })?;\n\n    log::info!(\n      \"{} laufey {} backend for {} (v{})\",\n      colors::green(\"Downloading\"),\n      backend,\n      target,\n      LAUFEY_VERSION,\n    );\n\n    let url = Url::parse(&laufey_release_url(&archive))?;\n    let progress_bar = ProgressBar::new(ProgressBarStyle::DownloadBars);\n    let progress = progress_bar.update(&archive);\n    // Send a real User-Agent — some CDNs (incl. parts of GitHub","sourceCodeStart":1909,"sourceCodeEnd":1945,"githubUrl":"https://github.com/denoland/deno/blob/89f33cbef296a2b287f323d42de54c871fa69c77/cli/tools/desktop.rs#L1909-L1945","documentation":"Error \"no pinned SHA-256 for {archive} in cli/laufey_sums.lock (regenerate when bumping LAUFEY_VERSION to v{LAUFEY_VERSION}; laufey v{LAUFEY_VERSION} release may not include backend '{backend}' for target '{target}')\" thrown in denoland/deno.","triggerScenarios":"Thrown at cli/tools/desktop.rs:1927 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"89f33cbef296a2b287f323d42de54c871fa69c77","analyzedAt":"2026-08-16T07:54:21.310Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}