{"record":{"id":"8aa4a217e5708675","repo":"hashicorp/nomad","slug":"invalid-s-checksum-v","errorCode":null,"errorMessage":"invalid %s checksum: %v","messagePattern":"invalid (.+?) checksum: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/structs.go","lineNumber":10005,"sourceCode":"\t\tif fips140.Enabled() {\n\t\t\treturn fmt.Errorf(\"md5 checksums are not supported in FIPS-140 mode\")\n\t\t}\n\t\texpectedLength = md5.Size\n\tcase \"sha1\":\n\t\tif fips140.Enabled() {\n\t\t\treturn fmt.Errorf(\"sha1 checksums are not supported in FIPS-140 mode\")\n\t\t}\n\t\texpectedLength = sha1.Size\n\tcase \"sha256\":\n\t\texpectedLength = sha256.Size\n\tcase \"sha512\":\n\t\texpectedLength = sha512.Size\n\tdefault:\n\t\treturn fmt.Errorf(\"unsupported checksum type: %s\", checksumType)\n\t}\n\n\tif len(checksumBytes) != expectedLength {\n\t\treturn fmt.Errorf(\"invalid %s checksum: %v\", checksumType, checksumVal)\n\t}\n\n\treturn nil\n}\n\nconst (\n\tConstraintDistinctProperty  = \"distinct_property\"\n\tConstraintDistinctHosts     = \"distinct_hosts\"\n\tConstraintRegex             = \"regexp\"\n\tConstraintVersion           = \"version\"\n\tConstraintSemver            = \"semver\"\n\tConstraintSetContains       = \"set_contains\"\n\tConstraintSetContainsAll    = \"set_contains_all\"\n\tConstraintSetContainsAny    = \"set_contains_any\"\n\tConstraintAttributeIsSet    = \"is_set\"\n\tConstraintAttributeIsNotSet = \"is_not_set\"\n)\n","sourceCodeStart":9987,"sourceCodeEnd":10023,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/structs.go#L9987-L10023","documentation":"After hex-decoding, the digest byte length must match the chosen algorithm exactly (md5:16, sha1:20, sha256:32, sha512:64 bytes). A hex-valid but wrong-length value fails with 'invalid <type> checksum: <value>'.","triggerScenarios":"Providing a sha256-length digest labeled as sha512, a truncated digest (e.g. first 16 chars of a sha256), or swapping type/value between artifact entries.","commonSituations":"Truncated hashes from log output; hand-rolled string slicing; mislabeling the algorithm when copying digests from release pages.","solutions":["Re-run the correct checksum command for the declared algorithm (e.g. sha256sum for type sha256).","Ensure the hex string has the exact expected length (32 chars md5, 40 sha1, 64 sha256, 128 sha512).","Fix the type prefix if the digest length is right but the label is wrong."],"exampleFix":"// before\nchecksum = \"sha512:3b5d2f...\"  # only 64 hex chars (a sha256)\n// after\nchecksum = \"sha256:3b5d2f...\"  # 64 hex chars, correctly typed","handlingStrategy":"validation","validationCode":"want := map[string]int{\"md5\":32,\"sha1\":40,\"sha256\":64,\"sha512\":128}\ntype, val, _ := strings.Cut(checksum, \":\")\nif n := want[type]; n > 0 && len(val) != n {\n    return fmt.Errorf(\"%s checksum must be %d hex chars, got %d\", type, n, len(val))\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify hex length: 32/40/64/128 for md5/sha1/sha256/sha512","Never truncate hashes from logs","Recompute the digest with the matching tool"],"tags":["nomad","checksum","validation","length"],"backgroundTag":"checksum-validation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}