{"record":{"id":"bd7484f600b929e6","repo":"multica-ai/multica","slug":"checksum-for-q-not-found-in-manifest","errorCode":null,"errorMessage":"checksum for %q not found in manifest","messagePattern":"checksum for %q not found in manifest","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/internal/cli/update.go","lineNumber":209,"sourceCode":"\tfor scanner.Scan() {\n\t\tline := strings.TrimSpace(scanner.Text())\n\t\tif line == \"\" || strings.HasPrefix(line, \"#\") {\n\t\t\tcontinue\n\t\t}\n\t\tfields := strings.Fields(line)\n\t\t// GoReleaser's default separator is two spaces; some tools use one\n\t\t// or pad with tabs. strings.Fields handles all of those at once.\n\t\tif len(fields) < 2 {\n\t\t\tcontinue\n\t\t}\n\t\tif fields[1] == assetName {\n\t\t\treturn strings.ToLower(fields[0]), nil\n\t\t}\n\t}\n\tif err := scanner.Err(); err != nil {\n\t\treturn \"\", fmt.Errorf(\"read checksum manifest: %w\", err)\n\t}\n\treturn \"\", fmt.Errorf(\"checksum for %q not found in manifest\", assetName)\n}\n\n// verifyAssetSHA256 returns nil when the SHA-256 of data matches the lowercase\n// hex expected value, or an error otherwise. The error includes both digests\n// so a corrupted asset is diagnosable from the log without re-downloading.\nfunc verifyAssetSHA256(data []byte, expectedHex, assetName string) error {\n\tif expectedHex == \"\" {\n\t\treturn fmt.Errorf(\"empty expected checksum for %q\", assetName)\n\t}\n\tsum := sha256.Sum256(data)\n\tactual := hex.EncodeToString(sum[:])\n\tif !strings.EqualFold(actual, expectedHex) {\n\t\treturn fmt.Errorf(\"checksum mismatch for %q: expected %s, got %s\", assetName, expectedHex, actual)\n\t}\n\treturn nil\n}\n\nfunc fetchReleaseByTag(tag string) (*GitHubRelease, error) {","sourceCodeStart":191,"sourceCodeEnd":227,"githubUrl":"https://github.com/multica-ai/multica/blob/2c0912b6ec764b373d44eeea1e80f0d9f11ab417/server/internal/cli/update.go#L191-L227","documentation":"The checksums.txt manifest parsed cleanly, but no line's filename field matched the selected asset name (the same name findReleaseAsset chose, e.g. multica-cli-1.2.3-darwin-arm64.tar.gz). The function deliberately errors rather than returning empty so a wrong manifest or typo fails closed instead of silently disabling verification.","triggerScenarios":"The manifest comes from a different release than the asset (version mismatch), the asset name in the manifest uses a different naming scheme than the archive (e.g. legacy multica_darwin_arm64.tar.gz in checksums but versioned name matched for download), or the release mixes GoReleaser outputs with manually added archives.","commonSituations":"A release where a legacy-named fallback archive was hand-uploaded after publishing; re-tagging a release so archive versions no longer match the manifest; mirroring that rewrites asset filenames.","solutions":["Open checksums.txt for the target release and confirm the exact filename it lists for your platform","Align the two naming schemes: regenerate the release so the manifest covers every published asset name","If a fallback archive is needed, also append its checksum line to checksums.txt before publishing","Update to the latest release, where the versioned scheme is consistent across assets and manifest"],"exampleFix":"# checksums.txt — before (missing versioned asset)\nabc...  multica_darwin_arm64.tar.gz\n\n# after (both schemes covered)\nabc...  multica_darwin_arm64.tar.gz\ndef...  multica-cli-1.2.3-darwin-arm64.tar.gz","handlingStrategy":"validation","validationCode":"lines := strings.Split(string(manifest), \"\\n\")\nfound := false\nfor _, l := range lines {\n\tfields := strings.Fields(l)\n\tif len(fields) >= 2 && fields[1] == assetName { found = true }\n}\nif !found { /* manifest does not cover this asset; refuse download */ }","typeGuard":null,"tryCatchPattern":"sum, err := cli.ParseChecksumManifest(manifest, assetName)\nif err != nil && strings.Contains(err.Error(), \"not found in manifest\") {\n\t// naming mismatch between asset and manifest; use a release where they align\n}","preventionTips":["Generate checksums.txt in the same release job that uploads the archives","When adding fallback-named assets, append their checksum lines too","Match the exact asset filename when scripting manual verification"],"tags":["checksum","release","naming","security","go"],"backgroundTag":null,"analyzedSha":"2c0912b6ec764b373d44eeea1e80f0d9f11ab417","analyzedAt":"2026-08-15T13:25:18.241Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}