{"record":{"id":"909ff41c913822a3","repo":"dotnet/aspnetcore","slug":"could-not-find-checksum-for-path-in-release-file","errorCode":null,"errorMessage":"Could not find checksum for {path} in Release file.","messagePattern":"Could not find checksum for (.+?) in Release file\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"eng/common/cross/install-debs.py","lineNumber":154,"sourceCode":"\n        print(\"Signature verified successfully.\")\n\n        with open(release_file.name) as f:\n            return f.read()\n\ndef parse_release_file(content, path):\n    \"\"\"Parses the Release file and returns sha256 checksum of the specified path.\"\"\"\n\n    # data looks like this:\n    # <checksum>  <size>  <path>\n    matches = re.findall(r'^ (\\S*) +(\\S*) +(\\S*)$', content, re.MULTILINE)\n\n    for entry in matches:\n        # the file has both md5 and sha256 checksums, we want sha256 which has a length of 64\n        if entry[2] == path and len(entry[0]) == 64:\n            return entry[0]\n\n    raise Exception(f\"Could not find checksum for {path} in Release file.\")\n\ndef parse_debian_version(version):\n    \"\"\"Parse a Debian package version into epoch, upstream version, and revision.\"\"\"\n    match = re.match(r'^(?:(\\d+):)?([^-]+)(?:-(.+))?$', version)\n    if not match:\n        raise ValueError(f\"Invalid Debian version format: {version}\")\n    epoch, upstream, revision = match.groups()\n    return int(epoch) if epoch else 0, upstream, revision or \"\"\n\ndef compare_upstream_version(v1, v2):\n    \"\"\"Compare upstream or revision parts using Debian rules.\"\"\"\n    def tokenize(version):\n        tokens = re.split(r'([0-9]+|[A-Za-z]+)', version)\n        return [int(x) if x.isdigit() else x for x in tokens if x]\n\n    tokens1 = tokenize(v1)\n    tokens2 = tokenize(v2)\n","sourceCodeStart":136,"sourceCodeEnd":172,"githubUrl":"https://github.com/dotnet/aspnetcore/blob/294cab2f9b2e03af6b953820c7ab497c3c8b7ad9/eng/common/cross/install-debs.py#L136-L172","documentation":"parse_release_file scans the Release file for a sha256 (64-hex-char) line whose third column matches the requested relative path (e.g., main/binary-amd64/Packages.gz). If no such entry exists, it raises a plain Exception. This means the Release file does not enumerate the package-index file the script tried to verify — typically because the suite/component/arch combination is wrong or the Release file is for a different distribution layout.","triggerScenarios":"Called from fetch_and_decompress when check_sig is True. Triggered when the constructed path (e.g., universe/binary-loong64/Packages.gz) is not listed in the Release file's sha256 checksum section. Common with non-main components, uncommon architectures, or suites that do not ship universe.","commonSituations":"Asking for a component (universe) the suite does not have; an arch the Release file does not enumerate (e.g., loong64 on a mainstream Debian mirror instead of the ports mirror); Release file from a minimal mirror that omits some indices.","solutions":["Verify the suite ships the requested component/arch by opening <mirror>/dists/<suite>/ in a browser and checking the directory listing.","For Debian ports architectures (loong64, riscv64 etc.), use the ports mirror (deb.debian.org/debian-ports) and the ports keyring, not mainstream debian.","Drop --force-check-gpg if you cannot fix the mirror layout — you lose the Release-anchored checksum but the per-deb SHA256 still verifies.","Inspect the downloaded Release file to see which paths it actually lists and adjust --suite/--arch accordingly."],"exampleFix":"# before — wrong mirror for a ports arch\npython3 install-debs.py --arch loong64 --force-check-gpg \\\n  --suite sid --mirror http://deb.debian.org/debian ...\n# Could not find checksum for main/binary-loong64/Packages.gz\n\n# after — use the ports mirror\npython3 install-debs.py --arch loong64 --force-check-gpg \\\n  --keyring /usr/share/keyrings/debian-ports-archive-keyring.gpg \\\n  --suite sid --mirror http://deb.debian.org/debian-ports ...","handlingStrategy":"validation","validationCode":"# Confirm the path is listed in the Release file before fetch_and_decompress\npath = f'{component}/binary-{arch}/Packages.gz'\nasync with session.get(release_url) as r:\n    release_text = await r.text()\nif path not in release_text:\n    print(f'{path} absent from Release for suite {suite}; wrong mirror/arch/component')\n    # skip verification for this path or abort","typeGuard":null,"tryCatchPattern":"try:\n    packages_sha = parse_release_file(release_file_content, path)\nexcept Exception as e:\n    if 'Could not find checksum' in str(e):\n        # mirror layout does not cover this path; either fix the mirror or skip sig check\n        print(f'{path} not in Release; consider --suite/--mirror change or drop --force-check-gpg')\n        return None\n    raise","preventionTips":["Match --arch to the mirror's enumerated architectures (ports mirror for ports arches).","Avoid --force-check-gpg on mirrors with incomplete Release coverage, or live without it.","Pre-validate that the Release file lists each Packages.gz path you intend to fetch.","Use mainstream Debian mirror for amd64/arm64 and the ports mirror for riscv64/loong64."],"tags":["python","debian","release-file","checksum","gpg","install-debs","rootfs"],"analyzedSha":"294cab2f9b2e03af6b953820c7ab497c3c8b7ad9","analyzedAt":"2026-08-06T20:08:02.189Z","schemaVersion":2},"datasetVersion":"2026-08-06T23:17:07.152Z"}