{"record":{"id":"e957bd77afd7ff0d","repo":"coleam00/Archon","slug":"checksum-not-found-for-filename-in-checksums-tx","errorCode":null,"errorMessage":"Checksum not found for ${filename} in checksums.txt","messagePattern":"Checksum not found for (.+?) in checksums\\.txt","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/cli/src/commands/serve.ts","lineNumber":306,"sourceCode":"  throw new Error(message);\n}\n\n/**\n * Parse a SHA-256 checksum from a checksums.txt file (sha256sum format).\n * Format: `<hash>  <filename>` or `<hash> <filename>`\n */\nexport function parseChecksum(checksums: string, filename: string): string {\n  for (const line of checksums.split('\\n')) {\n    const parts = line.trim().split(/\\s+/);\n    if (parts.length >= 2 && parts[1] === filename) {\n      const hash = parts[0];\n      if (!/^[0-9a-f]{64}$/.test(hash)) {\n        throw new Error(`Malformed checksum entry for ${filename}: \"${line.trim()}\"`);\n      }\n      return hash;\n    }\n  }\n  throw new Error(`Checksum not found for ${filename} in checksums.txt`);\n}\n","sourceCodeStart":288,"sourceCodeEnd":308,"githubUrl":"https://github.com/coleam00/Archon/blob/0773b9745896ef0612e709c80845a0f7db315b19/packages/cli/src/commands/serve.ts#L288-L308","documentation":"parseChecksum throws this when it finished scanning every line of the checksums.txt content without finding an entry whose filename column matches the requested file. It means the checksum manifest does not describe the artifact downloadWebDist wants to verify. The code fails closed rather than skipping verification.","triggerScenarios":"downloadWebDist -> parseChecksum(checksumsText, 'archon-web.tar.gz') iterates all lines and no line's second field equals 'archon-web.tar.gz': empty or HTML error-page body (fetch got a 200 with wrong content), manifest from a different release that names the artifact differently, or filename column separated by something the /\\s+/ split doesn't treat as the second field.","commonSituations":"Download URL for checksums.txt pointing to a 200-OK HTML page (captive portal, soft-404); release renamed the asset; stale cached manifest from an older release; line endings or extra columns shifting the filename out of parts[1].","solutions":["Print the fetched checksums body — if it's HTML or empty, fix the checksums URL or network path (proxy/captive portal) first.","Ensure the checksums.txt and tarball come from the same release; fetch both fresh from the matching release tag.","Confirm the manifest line format `<sha256>  <filename>` with the filename as the second whitespace-separated field.","If the asset was renamed upstream, update the CLI version to one requesting the current artifact name."],"exampleFix":"// before\nconst text = await checksumsRes.text(); // 200 with HTML soft-404\nconst hash = parseChecksum(text, 'archon-web.tar.gz'); // throws not found\n// after\nconst text = await checksumsRes.text();\nif (!text.includes('archon-web.tar.gz')) {\n  throw new Error(`checksums.txt body invalid (len=${text.length}), check URL`);\n}\nconst hash = parseChecksum(text, 'archon-web.tar.gz');","handlingStrategy":"validation","validationCode":"const text = await (await fetch(checksumsUrl)).text();\nconst hasEntry = text\n  .split('\\n')\n  .some((l) => l.trim().split(/\\s+/)[1] === 'archon-web.tar.gz');\nif (!hasEntry) {\n  throw new Error(\n    `checksums source at ${checksumsUrl} lacks an entry for archon-web.tar.gz ` +\n    `(body starts with: ${JSON.stringify(text.slice(0, 60))})` // shows HTML/soft-404 immediately\n  );\n}","typeGuard":null,"tryCatchPattern":"try {\n  await serveCommand();\n} catch (err) {\n  if (err instanceof Error && err.message.startsWith('Checksum not found for')) {\n    // dump the manifest body: if it's HTML/empty, fix the URL or network;\n    // if it's a real manifest, you fetched a release that names the artifact differently.\n  } else throw err;\n}","preventionTips":["Verify the checksums URL returns text/plain from the exact same release tag as the tarball.","Detect soft-404/HTML responses by checking Content-Type before parsing.","After upstream renames of release assets, update both URLs together.","Cache manifests keyed by release tag so a stale version can't be paired with a newer tarball."],"tags":["checksum","manifest","parsing","validation"],"backgroundTag":"checksum-entry-not-found","analyzedSha":"0773b9745896ef0612e709c80845a0f7db315b19","analyzedAt":"2026-09-01T02:28:07.064Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}