{"record":{"id":"8fc32d306f4af53f","repo":"Hmbown/CodeWhale","slug":"manifestname-checksum-mismatch-for-name","errorCode":null,"errorMessage":"${manifestName} checksum mismatch for ${name}","messagePattern":"(.+?) checksum mismatch for (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"critical","filePath":"scripts/release/assemble-release-assets.js","lineNumber":76,"sourceCode":"      `${label} does not match the authoritative inventory` +\n        `${missing.length > 0 ? `; missing: ${missing.join(\", \")}` : \"\"}` +\n        `${unexpected.length > 0 ? `; unexpected: ${unexpected.join(\", \")}` : \"\"}` +\n        `${actual.size !== actualNames.length ? \"; duplicate basenames are present\" : \"\"}`,\n    );\n  }\n}\n\nasync function assertManifest(directory, manifestName, expectedNames) {\n  const manifestPath = path.join(directory, manifestName);\n  const checksums = parseChecksumManifest(\n    await fs.readFile(manifestPath, \"utf8\"),\n    manifestName,\n  );\n  assertExactNames([...checksums.keys()], expectedNames, manifestName);\n  for (const name of expectedNames) {\n    const actual = await sha256(path.join(directory, name));\n    if (checksums.get(name) !== actual) {\n      throw new Error(`${manifestName} checksum mismatch for ${name}`);\n    }\n  }\n}\n\nasync function verifyAssetDirectory(directory) {\n  const entries = await fs.readdir(directory, { withFileTypes: true });\n  const nonFiles = entries.filter((entry) => !entry.isFile());\n  if (nonFiles.length > 0) {\n    throw new Error(\n      `Release asset directory must be flat; found: ${nonFiles.map((entry) => entry.name).join(\", \")}`,\n    );\n  }\n\n  const expected = allReleaseAssetNames();\n  assertExactNames(entries.map((entry) => entry.name), expected, \"Release asset directory\");\n  await assertManifest(directory, CHECKSUM_MANIFEST, checksummedReleaseAssetNames());\n  await assertManifest(directory, BUNDLE_CHECKSUM_MANIFEST, BUNDLE_ASSET_NAMES);\n  console.log(`Verified ${expected.length} release assets in ${directory}`);","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/8880682c63083a91624de936797efa3ce9e498fd/scripts/release/assemble-release-assets.js#L58-L94","documentation":"assertManifest() recomputed the sha256 of a file inside the asset directory and it differs from the digest recorded in CHECKSUM_MANIFEST or BUNDLE_CHECKSUM_MANIFEST. This is an integrity stop: the bytes on disk are not the bytes the manifest attests, so the release cannot ship. The manifest name and offending file are included in the message.","triggerScenarios":"A file modified after the manifest was written (editor or git normalizing line endings, a re-packaged archive, a partial write); a corrupted CI artifact download; a manifest carried over from a previous build while binaries are from the current one; disk-level corruption.","commonSituations":"CRLF normalization touching codewhale.bat or text assets between assembly and verification; mixing manifests and binaries from different CI attempts; flaky network truncating an artifact during download.","solutions":["Re-run assemble from the original artifacts so the manifest is regenerated over the exact shipped bytes — never hand-patch the manifest to match modified files","Confirm which side changed: sha256sum <file> versus the manifest row quoted in the message","If input artifacts may be corrupted, re-download them from the workflow run and re-assemble","Ensure nothing touches the output directory between assembly and verification (no editors, formatters, or sync agents)"],"exampleFix":"# before: assembly output was later touched by a formatter -> checksum mismatch for codewhale.bat\n\n# after: always assemble into a fresh directory and verify immediately\nrm -rf release-out\nnode scripts/release/assemble-release-assets.js downloaded-artifacts release-out\nnode scripts/release/assemble-release-assets.js --verify release-out","handlingStrategy":"validation","validationCode":"const { verifyAssetDirectory } = require(\"./scripts/release/assemble-release-assets\");\n// immediately before upload, in the same job that owns the directory:\nawait verifyAssetDirectory(outDir);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Assemble and verify in one step and upload in the same job — no editors, formatters, or sync tools in between","Run the verify step as the last gate right before upload, not on a copy made later","Never 'fix' a mismatch by editing the manifest; always regenerate it from the shipped bytes","Watch for line-ending normalization (CRLF) on text assets like codewhale.bat when artifacts pass through git on Windows"],"tags":["release","checksum","integrity","sha256","security"],"backgroundTag":null,"analyzedSha":"8880682c63083a91624de936797efa3ce9e498fd","analyzedAt":"2026-08-16T11:31:27.956Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}