{"record":{"id":"9b4268f7b875e887","repo":"hashicorp/nomad","slug":"checksum-value-cannot-be-empty","errorCode":null,"errorMessage":"checksum value cannot be empty","messagePattern":"checksum value cannot be empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/structs.go","lineNumber":9962,"sourceCode":"\treturn mErr.ErrorOrNil()\n}\n\nfunc (ta *TaskArtifact) validateChecksum() error {\n\tcheck, ok := ta.GetterOptions[\"checksum\"]\n\tif !ok {\n\t\treturn nil\n\t}\n\n\t// Job struct validation occurs before interpolation resolution can be effective.\n\t// Skip checking if checksum contain variable reference, and artifacts fetching will\n\t// eventually fail, if checksum is indeed invalid.\n\tif args.ContainsEnv(check) {\n\t\treturn nil\n\t}\n\n\tcheck = strings.TrimSpace(check)\n\tif check == \"\" {\n\t\treturn fmt.Errorf(\"checksum value cannot be empty\")\n\t}\n\n\t// Cut on the first colon only: a \"file:<url>\" checksum carries a URL\n\t// value that may itself contain colons (e.g. a port).\n\tchecksumType, checksumVal, ok := strings.Cut(check, \":\")\n\tif !ok {\n\t\treturn fmt.Errorf(`checksum must be given as \"type:value\"; got %q`, check)\n\t}\n\n\t// A \"file:<url>\" checksum tells go-getter to read the checksum from a\n\t// remote file rather than supplying a hex digest inline, so there is no\n\t// digest to validate here; the getter resolves it at fetch time.\n\tif checksumType == \"file\" {\n\t\treturn nil\n\t}\n\n\tchecksumBytes, err := hex.DecodeString(checksumVal)\n\tif err != nil {","sourceCodeStart":9944,"sourceCodeEnd":9980,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/structs.go#L9944-L9980","documentation":"After allowing env-interpolated checksums, the artifact validator trims whitespace and requires a non-empty checksum string. An empty (or whitespace-only) checksum gives go-getter nothing to verify against, so validation fails early with this error.","triggerScenarios":"Setting checksum = \"\" or checksum = \"   \" in an artifact block, or an interpolated variable (not caught by ContainsEnv) that renders empty at validate time.","commonSituations":"Templating pipelines that emit checksum=\"\" when an upstream build lacks a digest file; hand-edited HCL where the checksum value was deleted but the attribute kept.","solutions":["Provide a real checksum such as checksum = \"sha256:<hex>\".","Remove the checksum attribute entirely if you do not want verification.","Check the variable/template feeding the checksum so it never renders to an empty string."],"exampleFix":"// before\nartifact {\n  source      = \"https://example.com/app.tgz\"\n  destination = \"local/app\"\n  checksum    = \"\"\n}\n// after\nartifact {\n  source      = \"https://example.com/app.tgz\"\n  destination = \"local/app\"\n  checksum    = \"sha256:abc123...\"\n}","handlingStrategy":"validation","validationCode":"if err := structs.ValidateArtifactChecksum(strings.TrimSpace(checksum)); err != nil { return err } // or inline:\nif strings.TrimSpace(checksum) == \"\" { return errors.New(\"checksum must not be empty\") }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never emit checksum=\"\" from templates; omit the attribute instead","Validate templated job files before submit","Trim and check checksum values in CI before nomad job run"],"tags":["nomad","checksum","validation","artifact"],"backgroundTag":"checksum-validation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}