{"record":{"id":"96f3683a954af2bb","repo":"ipfs/kubo","slug":"import-hashfunction-q-is-not-allowed-for-use-in-i","errorCode":null,"errorMessage":"Import.HashFunction %q is not allowed for use in IPFS","messagePattern":"Import\\.HashFunction %q is not allowed for use in IPFS","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"config/import.go","lineNumber":149,"sourceCode":"\n\t// Validate UnixFSChunker format\n\tif !cfg.UnixFSChunker.IsDefault() {\n\t\tchunker := cfg.UnixFSChunker.WithDefault(DefaultUnixFSChunker)\n\t\tif !isValidChunker(chunker) {\n\t\t\treturn fmt.Errorf(\"Import.UnixFSChunker invalid format: %q (expected \\\"size-<bytes>\\\", \\\"rabin-<min>-<avg>-<max>\\\", or \\\"buzhash\\\")\", chunker)\n\t\t}\n\t}\n\n\t// Validate HashFunction\n\tif !cfg.HashFunction.IsDefault() {\n\t\thashFunc := cfg.HashFunction.WithDefault(DefaultHashFunction)\n\t\thashCode, ok := mh.Names[strings.ToLower(hashFunc)]\n\t\tif !ok {\n\t\t\treturn fmt.Errorf(\"Import.HashFunction unrecognized: %q\", hashFunc)\n\t\t}\n\t\t// Check if the hash is allowed by verifcid\n\t\tif !verifcid.DefaultAllowlist.IsAllowed(hashCode) {\n\t\t\treturn fmt.Errorf(\"Import.HashFunction %q is not allowed for use in IPFS\", hashFunc)\n\t\t}\n\t}\n\n\t// Validate UnixFSHAMTDirectorySizeEstimation\n\tif !cfg.UnixFSHAMTDirectorySizeEstimation.IsDefault() {\n\t\test := cfg.UnixFSHAMTDirectorySizeEstimation.WithDefault(DefaultUnixFSHAMTDirectorySizeEstimation)\n\t\tswitch est {\n\t\tcase HAMTSizeEstimationLinks, HAMTSizeEstimationBlock, HAMTSizeEstimationDisabled:\n\t\t\t// valid\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"Import.UnixFSHAMTDirectorySizeEstimation must be %q, %q, or %q, got %q\",\n\t\t\t\tHAMTSizeEstimationLinks, HAMTSizeEstimationBlock, HAMTSizeEstimationDisabled, est)\n\t\t}\n\t}\n\n\t// Validate UnixFSDAGLayout\n\tif !cfg.UnixFSDAGLayout.IsDefault() {\n\t\tlayout := cfg.UnixFSDAGLayout.WithDefault(DefaultUnixFSDAGLayout)","sourceCodeStart":131,"sourceCodeEnd":167,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/config/import.go#L131-L167","documentation":"After resolving Import.HashFunction to a multihash code, ValidateImportConfig checks it against verifcid.DefaultAllowlist, the set of hashes kubo allows for CID verification. A syntactically valid multihash that the allowlist rejects (e.g. md5, sha1, or non-standard hashes) is refused with this error, because blocks/CIDs produced with it would not be verifiable on the network.","triggerScenarios":"Setting Import.HashFunction to a real multihash name that verifcid.DefaultAllowlist.IsAllowed() rejects (e.g. 'sha1', 'md5', 'dbl-sha2-256', or uncommon hashes like 'sha3-512' depending on allowlist) and starting the daemon or adding data.","commonSituations":"Deliberately choosing a 'stronger' or alternative hash for imports without realizing kubo's verifcid policy forbids it; migrating configs between tools where the other tool allows the hash; upgrading kubo where the allowlist is the enforcement point.","solutions":["Switch Import.HashFunction to an allowed hash such as 'sha2-256' (default), 'sha2-512', or 'blake2b-256': ipfs config Import.HashFunction sha2-256","Reset to default: ipfs config --json Import.HashFunction null","Check whether the hash is permitted via verifcid.DefaultAllowlist in github.com/ipfs/boxo/verifcid before configuring it"],"exampleFix":"// before\nipfs config Import.HashFunction sha1\n// after\nipfs config Import.HashFunction sha2-256","handlingStrategy":"validation","validationCode":"code, ok := mh.Names[strings.ToLower(name)]\nif ok && !verifcid.DefaultAllowlist.IsAllowed(code) {\n\treturn fmt.Errorf(\"hash %q not allowed by verifcid\", name)\n}","typeGuard":"func isAllowlistedHash(name string) bool {\n\tcode, ok := mh.Names[strings.ToLower(name)]\n\treturn ok && verifcid.DefaultAllowlist.IsAllowed(code)\n}","tryCatchPattern":null,"preventionTips":["Stick to sha2-256 (default), sha2-512, or blake2b-256 for imports","Consult verifcid.DefaultAllowlist in boxo before choosing an exotic hash","Remember the constraint is policy (network verifiability), not just syntax"],"tags":["config","hash","verifcid","validation"],"backgroundTag":"hash-not-allowed","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}