{"record":{"id":"aeb51eb4f88b7b76","repo":"router-for-me/CLIProxyAPI","slug":"checksum-for-s-not-found","errorCode":null,"errorMessage":"checksum for %s not found","messagePattern":"checksum for (.+?) not found","errorType":"http","errorClass":null,"httpStatus":502,"severity":"error","filePath":"internal/pluginstore/checksum.go","lineNumber":37,"sourceCode":"\t\t\treturn nil, fmt.Errorf(\"line %d: invalid checksum entry\", lineNumber+1)\n\t\t}\n\t\thash := strings.ToLower(strings.TrimSpace(fields[0]))\n\t\tif len(hash) != sha256.Size*2 {\n\t\t\treturn nil, fmt.Errorf(\"line %d: invalid sha256 length\", lineNumber+1)\n\t\t}\n\t\tif _, errDecode := hex.DecodeString(hash); errDecode != nil {\n\t\t\treturn nil, fmt.Errorf(\"line %d: invalid sha256: %w\", lineNumber+1, errDecode)\n\t\t}\n\t\tname := strings.TrimPrefix(strings.TrimSpace(fields[1]), \"*\")\n\t\tout[name] = hash\n\t}\n\treturn out, nil\n}\n\nfunc VerifyChecksum(name string, data []byte, checksums map[string]string) error {\n\texpected := strings.ToLower(strings.TrimSpace(checksums[name]))\n\tif expected == \"\" {\n\t\treturn fmt.Errorf(\"checksum for %s not found\", name)\n\t}\n\tactualBytes := sha256.Sum256(data)\n\tactual := hex.EncodeToString(actualBytes[:])\n\tif actual != expected {\n\t\treturn fmt.Errorf(\"checksum mismatch for %s\", name)\n\t}\n\treturn nil\n}\n","sourceCodeStart":19,"sourceCodeEnd":46,"githubUrl":"https://github.com/router-for-me/CLIProxyAPI/blob/78f0c4079e3e6273d65d03b5549cffc898703264/internal/pluginstore/checksum.go#L19-L46","documentation":"VerifyChecksum was asked to verify a named artifact, but the parsed checksums map has no entry for that name — the expected value is empty. This fails closed: without a known-good digest the store refuses to trust the artifact. The name lookup is exact, so path/matching issues are the most common cause rather than a genuinely missing entry.","triggerScenarios":"Verifying 'plugin.wasm' when the checksums file lists it as 'dist/plugin.wasm' or './plugin.wasm' (or with a Windows path), so map keys and the requested name disagree.","commonSituations":"Checksums generated from a different working directory than the verifier uses; artifact renamed between store index and checksums publication; checksums file for an older release that predates the artifact.","solutions":["Align names: regenerate checksums from the same directory/prefix the verifier uses, or pass the exact key from the file (leading '*' is already trimmed)","Confirm the checksums file shipped with this store version actually lists the artifact you are downloading","If publishing a store, generate checksums with relative paths matching the registry's artifact names"],"exampleFix":"# before (checksums.txt)\ne3b0c44...855  dist/plugin.wasm\n# verify called with \"plugin.wasm\" -> not found\n\n# after (checksums.txt)\ne3b0c44...855  plugin.wasm\n# verify called with \"plugin.wasm\" -> ok","handlingStrategy":"validation","validationCode":"checklist, err := ParseChecksums(checksumFile)\nif err != nil { return err }\nif _, ok := checklist[artifactName]; !ok {\n    return fmt.Errorf(\"checksums file lacks entry for %q; available: %v\", artifactName, keys(checklist))\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Generate checksums from the same directory and with the same relative names the verifier will use","On publish, assert every artifact named in the registry index has a checksums entry before shipping"],"tags":["checksum","integrity","plugin-store","naming"],"backgroundTag":null,"analyzedSha":"78f0c4079e3e6273d65d03b5549cffc898703264","analyzedAt":"2026-08-15T12:26:37.444Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}