{"record":{"id":"d68967bd56839597","repo":"multica-ai/multica","slug":"download-checksum-manifest-w","errorCode":null,"errorMessage":"download checksum manifest: %w","messagePattern":"download checksum manifest: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/internal/cli/update.go","lineNumber":404,"sourceCode":"\t}\n\tasset, err := findReleaseAsset(release.Assets, tag, runtime.GOOS, runtime.GOARCH)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tmanifestAsset, err := findChecksumManifestAsset(release.Assets)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tdownloadURL := asset.BrowserDownloadURL\n\tassetName := asset.Name\n\n\t// Pull the checksum manifest first so a release that is half-published\n\t// (archives uploaded but checksums.txt not yet) fails before we eat the\n\t// archive's bandwidth.\n\ttimeout := updateDownloadTimeoutOrDefault(downloadTimeout)\n\tmanifestData, err := fetchURLBytes(manifestAsset.BrowserDownloadURL, timeout)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"download checksum manifest: %w\", err)\n\t}\n\texpectedSum, err := parseChecksumManifest(manifestData, assetName)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"parse checksum manifest: %w\", err)\n\t}\n\n\t// Buffer the archive into memory so we can verify the full SHA-256\n\t// before writing anything to disk. Release archives are ~10–30 MB; the\n\t// extraction code already buffers zip archives in full (random access\n\t// requirement), so this is not a new memory cost on Windows. For tar.gz\n\t// it adds a single in-RAM copy, which is preferable to running the\n\t// untrusted bytes through gzip+tar extraction before the SHA-256 check.\n\tarchiveData, err := fetchURLBytes(downloadURL, timeout)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"download failed: %w\", err)\n\t}\n\n\tif err := verifyAssetSHA256(archiveData, expectedSum, assetName); err != nil {","sourceCodeStart":386,"sourceCodeEnd":422,"githubUrl":"https://github.com/multica-ai/multica/blob/2c0912b6ec764b373d44eeea1e80f0d9f11ab417/server/internal/cli/update.go#L386-L422","documentation":"Before downloading the archive, the updater fetches checksums.txt (the GoReleaser manifest asset) so half-published releases fail fast; a fetch failure is wrapped as 'download checksum manifest: %w'. The underlying error is usually the 'HTTP %d from %s' error from fetchURLBytes or a transport error (timeout, DNS).","triggerScenarios":"The release exists but checksums.txt has not been uploaded yet (publish race); checksums.txt was deleted from the release; a CDN 5xx or timeout while fetching the small manifest; rate limiting on the asset download endpoint.","commonSituations":"Updating immediately after a release announcement while the GoReleaser pipeline is still running; releases whose assets were edited manually and the manifest was removed.","solutions":["Open the release page and confirm checksums.txt is listed; if missing, wait for the pipeline or re-run the release job.","Retry after a short delay — the poller's next tick re-attempts by design.","For HTTP status errors, apply the same diagnosis as fetchURLBytes (rate limit vs 404 vs 5xx).","Never skip the checksum step manually; a missing manifest is treated as a failed update on purpose."],"exampleFix":"null","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"out, err := cli.UpdateViaDownload(ver)\nif err != nil {\n    if strings.HasPrefix(err.Error(), \"download checksum manifest\") {\n        // half-published release or transient CDN error; retry next tick\n        return scheduleRetry(err)\n    }\n}","preventionTips":["Delay update checks until the release pipeline reports all assets uploaded","Never publish releases with checksums.txt missing","Retry with backoff rather than disabling checksum verification"],"tags":["checksum","download","release","network"],"backgroundTag":null,"analyzedSha":"2c0912b6ec764b373d44eeea1e80f0d9f11ab417","analyzedAt":"2026-08-15T13:25:18.241Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}