{"record":{"id":"c3133771a7b93f6c","repo":"denoland/deno","slug":"checked-in-appimage-runtime-stub-does-not-match","errorCode":null,"errorMessage":"checked-in AppImage runtime stub {} does not match the SHA-256 pinned in cli/tools/appimage_runtime/README.md (expected {expected}, got {actual}). If this update is intentional, refresh both the binary and the README.","messagePattern":"checked-in AppImage runtime stub (.+?) does not match the SHA-256 pinned in cli/tools/appimage_runtime/README\\.md \\(expected (.+?), got (.+?)\\)\\. If this update is intentional, refresh both the binary and the README\\.","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"cli/build.rs","lineNumber":395,"sourceCode":"  (\n    \"tools/appimage_runtime/runtime-aarch64\",\n    \"00cbdfcf917cc6c0ff6d3347d59e0ca1f7f45a6df1a428a0d6d8a78664d87444\",\n  ),\n];\n\nfn check_appimage_runtime_hashes() {\n  use sha2::Digest;\n  let manifest_dir = env::var(\"CARGO_MANIFEST_DIR\").unwrap();\n  for (rel, expected) in APPIMAGE_RUNTIME_HASHES {\n    let path = Path::new(&manifest_dir).join(rel);\n    println!(\"cargo:rerun-if-changed={}\", path.display());\n    let bytes = match std::fs::read(&path) {\n      Ok(b) => b,\n      Err(_) => continue,\n    };\n    let actual = format!(\"{:x}\", sha2::Sha256::digest(&bytes));\n    if actual != *expected {\n      panic!(\n        \"checked-in AppImage runtime stub {} does not match the SHA-256 \\\n         pinned in cli/tools/appimage_runtime/README.md (expected {expected}, got {actual}). \\\n         If this update is intentional, refresh both the binary and the README.\",\n        path.display()\n      );\n    }\n  }\n}\n\nfn compress_appimage_runtimes(out_dir: &Path) {\n  let manifest_dir = env::var(\"CARGO_MANIFEST_DIR\").unwrap();\n  let output_dir = out_dir.join(\"appimage_runtime\");\n  std::fs::create_dir_all(&output_dir).unwrap();\n\n  for (rel, _) in APPIMAGE_RUNTIME_HASHES {\n    let path = Path::new(&manifest_dir).join(rel);\n    let contents = std::fs::read(&path).unwrap();\n    let compressed = zstd::bulk::compress(&contents, 19).unwrap();","sourceCodeStart":377,"sourceCodeEnd":413,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/cli/build.rs#L377-L413","documentation":"cli/build.rs pins SHA-256 digests for the vendored AppImage Type-2 runtime stubs (APPIMAGE_RUNTIME_HASHES, mirrored in cli/tools/appimage_runtime/README.md). check_appimage_runtime_hashes (build.rs:385-403) hashes each checked-in binary at build time and panics on a mismatch — a guard so a silent local modification or bad rebase cannot slip into a release build. A missing file is tolerated (the read error is skipped with continue); only a present-but-different binary triggers the panic.","triggerScenarios":"Rebuilding after locally patching or rewriting a runtime stub; git filters, autocrlf, or permission rewrites touching the binary; rebases that restore an older stub version; corrupted files from a flaky fetch.","commonSituations":"Intentional runtime bumps that updated the binary but not the README/build.rs pins; contributors on Windows line-ending configs corrupting binaries; partial checkouts after conflict resolution.","solutions":["If unintentional: restore the originals — git checkout -- cli/tools/appimage_runtime/ — then rebuild.","Verify manually: sha256sum cli/tools/appimage_runtime/<file> against the table in cli/tools/appimage_runtime/README.md.","If the update is intentional: replace the stub and refresh both APPIMAGE_RUNTIME_HASHES in cli/build.rs and the README table in the same commit, as the panic message instructs."],"exampleFix":"# before\ncargo build --release\n# panic: checked-in AppImage runtime stub ... does not match the SHA-256 ...\n\n# after\ngit checkout -- cli/tools/appimage_runtime/\nsha256sum cli/tools/appimage_runtime/*  # compare with README table\ncargo build --release","handlingStrategy":"validation","validationCode":"# preflight: verify pinned runtime stubs before a release build\ncd cli/tools/appimage_runtime\nsha256sum * # compare each line against the table in README.md","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never hand-edit vendored binaries; restore with git checkout -- cli/tools/appimage_runtime/","When bumping a runtime stub, update the binary, APPIMAGE_RUNTIME_HASHES in cli/build.rs, and the README table in one commit","Disable git filters/autocrlf for binary paths so checkouts do not rewrite the stubs"],"tags":["deno","build","cargo","build-script","appimage","sha256","integrity-check"],"backgroundTag":"checksum-verification-failed","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}