{"record":{"id":"8ccc8e8622de39b2","repo":"jdx/mise","slug":"invalid-checksum-format","errorCode":null,"errorMessage":"Invalid checksum format: {}","messagePattern":"Invalid checksum format: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/backend/static_helpers.rs","lineNumber":906,"sourceCode":"                \"Size mismatch: expected {}, got {}\",\n                expected_size,\n                actual_size\n            );\n        }\n    }\n\n    Ok(())\n}\n\npub(crate) fn verify_checksum_str(\n    file_path: &Path,\n    checksum: &str,\n    pr: Option<&dyn SingleReport>,\n) -> Result<()> {\n    if let Some((algo, hash_str)) = checksum.split_once(':') {\n        hash::ensure_checksum(file_path, hash_str, pr, algo)?;\n    } else {\n        bail!(\"Invalid checksum format: {}\", checksum);\n    }\n    Ok(())\n}\n\n/// File extensions that indicate non-binary files.\nconst SKIP_EXTENSIONS: &[&str] = &[\".txt\", \".md\", \".json\", \".yml\", \".yaml\"];\n\n/// File names (case-insensitive) that should be skipped when looking for executables.\nconst SKIP_FILE_NAMES: &[&str] = &[\"LICENSE\", \"README\"];\n\n/// Checks if a file should be skipped when searching for executables.\n///\n/// # Arguments\n/// * `file_name` - The file name to check\n/// * `strict` - If true, also checks against SKIP_FILE_NAMES and README.* patterns\n///\n/// # Returns\n/// * `true` if the file should be skipped (not a binary)","sourceCodeStart":888,"sourceCodeEnd":924,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/backend/static_helpers.rs#L888-L924","documentation":"verify_checksum_str expects the configured checksum in 'algo:hash' form (e.g. sha256:abcd...). If split_once(':') finds no colon, the string is not a parseable algo+hash pair, so mise rejects it before any hashing happens.","triggerScenarios":"verify_artifact calls verify_checksum_str with a checksum string lacking the ':' separator — e.g. metadata/config supplies a bare hex digest or a plain filename instead of 'sha256:<hex>'.","commonSituations":"Copy-pasting only the digest from a release page into a config that expects the algo prefix; writing the sha256sums file line verbatim (which separates with spaces, not colons); hand-editing tool metadata.","solutions":["Prefix the digest with its algorithm: 'sha256:<hex>'","Check the source metadata file's documented checksum format","Regenerate the checksum with shasum -a 256 and format it as algo:hash"],"exampleFix":"// before\ndownload.checksum = '9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08'\n// after\ndownload.checksum = 'sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08'","handlingStrategy":"validation","validationCode":"// validate checksum format before configuring\necho \"$CHECKSUM\" | grep -Eq '^(sha256|sha512|sha1|md5):[0-9a-fA-F]+$' || echo \"must be algo:hash\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always store checksums as '<algo>:<hex>'","When copying from sha256sums output, prepend the algorithm manually","Add a config lint that enforces the algo:hash pattern"],"tags":["checksum","format","validation"],"backgroundTag":"invalid-argument-format","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}