{"record":{"id":"c10286ac662ba108","repo":"apple/pkl","slug":"invalidpackageurichecksum","errorCode":"invalidPackageUriChecksum","errorMessage":"ErrorMessages.create(\"invalidPackageUriChecksum\", checksumPart)","messagePattern":"ErrorMessages\\.create\\(\"invalidPackageUriChecksum\", checksumPart\\)","errorType":"error_code","errorClass":"URISyntaxException","httpStatus":null,"severity":"error","filePath":"pkl-core/src/main/java/org/pkl/core/packages/PackageUri.java","lineNumber":194,"sourceCode":"              uri.getQuery(),\n              uri.getFragment()));\n    } catch (URISyntaxException e) {\n      throw PklBugException.unreachableCode();\n    }\n  }\n\n  public String getPathWithoutVersion() {\n    return pathWithoutVersion;\n  }\n\n  public @Nullable Checksums getChecksums() {\n    return checksums;\n  }\n\n  private Checksums parseChecksumPart(String checksumPart) throws URISyntaxException {\n    var parts = checksumPart.split(\":\");\n    if (parts.length != 2) {\n      throw new URISyntaxException(\n          uri.toString(), ErrorMessages.create(\"invalidPackageUriChecksum\", checksumPart));\n    }\n    var algorithm = parts[0];\n    var checksum = parts[1];\n    if (!algorithm.equals(\"sha256\")) {\n      throw new URISyntaxException(\n          uri.toString(), ErrorMessages.create(\"unknownChecksumAlgorithm\", algorithm));\n    }\n    return new Checksums(checksum);\n  }\n}\n","sourceCodeStart":176,"sourceCodeEnd":206,"githubUrl":"https://github.com/apple/pkl/blob/f3efcbfc9b60d30053b0536d664948d7aa1b8673/pkl-core/src/main/java/org/pkl/core/packages/PackageUri.java#L176-L206","documentation":"Thrown by PackageUri.parseChecksumPart when the '::'-delimited checksum component is not exactly 'algorithm:checksum' (a single colon splitting into two parts). The optional checksums suffix of a package URI must look like '::sha256:abc123...'.","triggerScenarios":"Parsing a package URI whose checksum suffix has the wrong shape: extra colons, missing the algorithm, or empty checksum, e.g. '::sha256' or ':::abc' or '::abc:def:ghi'.","commonSituations":"Hand-editing a checksummed dependency URI; truncating or concatenating checksum strings; copying a URI with formatting artifacts that add or remove colons.","solutions":["Format the checksum suffix as '::sha256:<hex-checksum>' exactly","Verify the URI was not truncated or mangled by copy/paste or string processing","Remove the checksum component entirely if you don't need checksum verification"],"exampleFix":"// before\nvar uri = \"package://example.com/my-pkg@1.2.3::sha256\";\n// after\nvar uri = \"package://example.com/my-pkg@1.2.3::sha256:4f3c...\";","handlingStrategy":"validation","validationCode":"boolean hasValidChecksumPart(String uriStr) {\n  int idx = uriStr.indexOf(\"::\");\n  if (idx == -1) return true;\n  var part = uriStr.substring(idx + 2);\n  String[] pieces = part.split(\":\");\n  return pieces.length == 2 && !pieces[0].isEmpty() && !pieces[1].isEmpty();\n}","typeGuard":null,"tryCatchPattern":"try {\n  var pkg = new PackageUri(URI.create(uriStr));\n} catch (URISyntaxException e) {\n  throw new IllegalArgumentException(\"Malformed checksum component (want '::sha256:<hex>'): \" + uriStr, e);\n}","preventionTips":["Format checksum suffixes exactly as '::sha256:<hex>'","Avoid hand-editing checksummed URIs; regenerate them with tooling","Watch for string processing that adds/removes colons"],"tags":["pkl","package-uri","checksum","format"],"backgroundTag":"checksum-mismatch","analyzedSha":"f3efcbfc9b60d30053b0536d664948d7aa1b8673","analyzedAt":"2026-09-08T13:10:45.570Z","contentChangedAt":"2026-09-08T13:10:45.570Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}