{"record":{"id":"9792394b6065081f","repo":"github/copilot-sdk","slug":"sha256sums-txt-does-not-contain-s","errorCode":null,"errorMessage":"SHA256SUMS.txt does not contain %s","messagePattern":"SHA256SUMS\\.txt does not contain (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"go/cmd/bundler/main.go","lineNumber":984,"sourceCode":"\t\tfmt.Printf(\"Downloading checksums from %s...\\n\", checksumsURL)\n\t\tresp, err := releaseHTTPClient.Get(checksumsURL)\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"failed to download checksums: %w\", err)\n\t\t}\n\t\tdefer resp.Body.Close()\n\t\tif resp.StatusCode != http.StatusOK {\n\t\t\treturn \"\", fmt.Errorf(\"failed to download checksums: %s\", resp.Status)\n\t\t}\n\t\tcontents, err := io.ReadAll(resp.Body)\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"failed to read checksums: %w\", err)\n\t\t}\n\t\tchecksums = parseReleaseChecksums(string(contents))\n\t\treleaseChecksumCache[cacheKey] = checksums\n\t}\n\tchecksum, ok := checksums[assetName]\n\tif !ok {\n\t\treturn \"\", fmt.Errorf(\"SHA256SUMS.txt does not contain %s\", assetName)\n\t}\n\treturn checksum, nil\n}\n\n// downloadCLIBinary downloads the verified release package and extracts the CLI binary. It\n// returns the extracted binary path and the downloaded tarball path (retained so\n// callers can extract additional files, such as the runtime library).\nfunc downloadCLIBinary(runtimePlatform, binaryName, cliVersion, destDir string) (string, string, error) {\n\tassetName := releaseAssetName(cliVersion, runtimePlatform)\n\texpectedChecksum, err := getReleaseChecksum(cliVersion, assetName)\n\tif err != nil {\n\t\treturn \"\", \"\", err\n\t}\n\ttarballURL := releaseDownloadURL(cliVersion, assetName)\n\n\tfmt.Printf(\"Downloading from %s...\\n\", tarballURL)\n\n\tresp, err := releaseHTTPClient.Get(tarballURL)","sourceCodeStart":966,"sourceCodeEnd":1002,"githubUrl":"https://github.com/github/copilot-sdk/blob/cd8cf15dc3f9e762615790aaed0a771a0f392755/go/cmd/bundler/main.go#L966-L1002","documentation":"After successfully parsing SHA256SUMS.txt, getReleaseChecksum looks up the expected asset name and errors if it is absent. This is a safeguard so the bundler never downloads a package it cannot checksum-verify.","triggerScenarios":"checksums map has no entry for assetName — the platform/arch asset filename built by the bundler is not listed in that release's SHA256SUMS.txt.","commonSituations":"Version bump where the release renamed assets (GOOS/GOARCH naming change); requesting an asset for an unsupported OS/arch; partial upload of the release missing the checksum entry; assetName constructed with wrong extension or suffix.","solutions":["Compare assetName against the actual entries in SHA256SUMS.txt (curl + grep)","Fix the assetName construction (releaseDownloadURL/asset naming) to match upstream naming","Use a version whose SHA256SUMS.txt includes your target platform, or skip unsupported platforms in the build matrix","If you control the release, re-upload complete SHA256SUMS.txt"],"exampleFix":"// before\nchecksum, ok := checksums[assetName]\nif !ok {\n\treturn \"\", fmt.Errorf(\"SHA256SUMS.txt does not contain %s\", assetName)\n}\n// after\nchecksum, ok := checksums[assetName]\nif !ok {\n\treturn \"\", fmt.Errorf(\"SHA256SUMS.txt does not contain %s (available: %v)\", assetName, keys(checksums))\n}","handlingStrategy":"validation","validationCode":"sums, err := fetchChecksums(baseURL, version)\nif err != nil { return err }\nif _, ok := sums[assetName]; !ok {\n\treturn fmt.Errorf(\"asset %s not listed in checksums for v%s; check platform/arch support\", assetName, version)\n}","typeGuard":"func checksumAvailable(checksums map[string]string, assetName string) bool {\n\t_, ok := checksums[assetName]\n\treturn ok\n}","tryCatchPattern":"checksum, err := getReleaseChecksum(baseURL, version, assetName)\nif err != nil {\n\tif strings.Contains(err.Error(), \"does not contain\") {\n\t\t// wrong version or unsupported platform; fix assetName/version\n\t}\n\treturn err\n}","preventionTips":["Compare assetName with real SHA256SUMS.txt entries after every version bump","Skip unsupported GOOS/GOARCH combos in your build matrix","Verify checksums are fully uploaded when you control the release","Keep asset-naming logic in one tested helper"],"tags":["checksum","release","versioning","go"],"backgroundTag":"resource-not-found","analyzedSha":"cd8cf15dc3f9e762615790aaed0a771a0f392755","analyzedAt":"2026-09-09T18:32:31.973Z","contentChangedAt":"2026-09-09T18:32:31.973Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}