{"record":{"id":"d55e3d6ec6f4a21a","repo":"oraios/serena","slug":"no-sha256-checksum-configured-for-taplo-archive","errorCode":null,"errorMessage":"No SHA256 checksum configured for Taplo archive: {archive_filename}","messagePattern":"No SHA256 checksum configured for Taplo archive: (.+?)","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"src/solidlsp/language_servers/taplo_server.py","lineNumber":184,"sourceCode":"                raise FileNotFoundError(\n                    f\"Taplo executable not found at {taplo_executable}. \"\n                    \"Installation may have failed. Try installing manually: cargo install taplo-cli --locked\"\n                )\n\n            return taplo_executable\n\n        def _create_launch_command(self, core_path: str) -> list[str]:\n            return [core_path, \"lsp\", \"stdio\"]\n\n        @classmethod\n        def _download_taplo(cls, install_dir: str, executable_path: str, version: str = DEFAULT_TAPLO_VERSION) -> None:\n            \"\"\"Download and extract Taplo binary using the shared verified download helper.\"\"\"\n            download_url, _ = _get_taplo_download_url(version)\n            archive_filename = os.path.basename(download_url)\n            # only verify the SHA when the resolved version is one of our pinned ones (INITIAL or current DEFAULT)\n            expected_hash = _taplo_sha(version, archive_filename)\n            if expected_hash is None and version in (INITIAL_TAPLO_VERSION, DEFAULT_TAPLO_VERSION):\n                raise RuntimeError(f\"No SHA256 checksum configured for Taplo archive: {archive_filename}\")\n\n            try:\n                log.info(f\"Downloading Taplo from: {download_url}\")\n                archive_type = \"zip\" if archive_filename.endswith(\".zip\") else \"gz\"\n                target_path = install_dir if archive_type == \"zip\" else executable_path\n                FileUtils.download_and_extract_archive_verified(\n                    download_url,\n                    target_path,\n                    archive_type,\n                    expected_sha256=expected_hash,\n                    allowed_hosts=TAPLO_ALLOWED_HOSTS,\n                )\n\n                # Make executable on Unix systems\n                if os.name != \"nt\":\n                    os.chmod(executable_path, os.stat(executable_path).st_mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)\n\n                log.info(f\"Taplo installed successfully at: {executable_path}\")","sourceCodeStart":166,"sourceCodeEnd":202,"githubUrl":"https://github.com/oraios/serena/blob/7fcbca7e62555ec2287ddb2f083caee805848ea6/src/solidlsp/language_servers/taplo_server.py#L166-L202","documentation":"_download_taplo refuses to download a Taplo archive when no SHA256 checksum is configured for the resolved version/archive filename pair, unless the version is not one of the pinned ones. This library enforces checksum-verified downloads to guarantee supply-chain integrity; an unknown version without a pinned hash means it cannot verify the archive, so it raises RuntimeError instead of downloading blindly.","triggerScenarios":"Calling _get_or_install_core_dependency on Taplo when `taplo` is absent from PATH and the configured Taplo version resolves to a version whose archive filename has no entry in the SHA256 table (e.g. a custom DEFAULT_TAPLO_VERSION bump without adding the new hash, while version is still INITIAL or DEFAULT so the guard applies).","commonSituations":"Upgrading DEFAULT_TAPLO_VERSION in code without adding the new archive's SHA256; overriding the Taplo version via settings to an unpinned release; a new Taplo release changing archive naming so _taplo_sha misses the lookup.","solutions":["Add the SHA256 entry for the new version's archive filename to the checksum table used by _taplo_sha (compute via `sha256sum <archive>`).","Pin back to a supported version (INITIAL or DEFAULT) that already has a configured checksum.","Install Taplo manually (`cargo install taplo-cli --locked`) so the download path is never taken."],"exampleFix":"// before\ndefault_taplo_version = \"0.19.3\"  # bumped, but no SHA registered\n// after\ndefault_taplo_version = \"0.19.3\"\n# add to checksum table:\n# \"taplo-0.19.3-x86_64-unknown-linux-musl.tar.gz\": \"<sha256...>\"","handlingStrategy":"validation","validationCode":"from solidlsp.language_servers.taplo_server import _taplo_sha, INITIAL_TAPLO_VERSION, DEFAULT_TAPLO_VERSION\nversion = \"<configured taplo version>\"\narchive = f\"taplo-{version}-x86_64-unknown-linux-musl.tar.gz\"\nif _taplo_sha(version, archive) is None:\n    raise ValueError(f\"No SHA256 configured for {archive}; pin a known version or add its checksum\")","typeGuard":null,"tryCatchPattern":"try:\n    server = SolidLanguageServer.create(\"taplo\")\nexcept RuntimeError as e:\n    if \"No SHA256 checksum\" in str(e):\n        # fall back to pinned version or manual install\n        os.environ[\"SOLIDLSP_TAPLO_VERSION\"] = DEFAULT_TAPLO_VERSION\n        server = SolidLanguageServer.create(\"taplo\")\n    else:\n        raise","preventionTips":["When bumping the Taplo version, always add the new archive's SHA256 to the checksum table in the same commit.","Pin to supported versions (INITIAL or DEFAULT) rather than arbitrary releases.","Add a test asserting every supported version has a registered checksum."],"tags":["taplo","checksum","sha256","supply-chain","version-pinning"],"backgroundTag":"missing-checksum-configuration","analyzedSha":"7fcbca7e62555ec2287ddb2f083caee805848ea6","analyzedAt":"2026-08-29T00:04:09.619Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}