{"record":{"id":"e97d4769f4bf2c62","repo":"multica-ai/multica","slug":"parse-checksum-manifest-w","errorCode":null,"errorMessage":"parse checksum manifest: %w","messagePattern":"parse checksum manifest: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/internal/cli/update.go","lineNumber":408,"sourceCode":"\t}\n\tmanifestAsset, err := findChecksumManifestAsset(release.Assets)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tdownloadURL := asset.BrowserDownloadURL\n\tassetName := asset.Name\n\n\t// Pull the checksum manifest first so a release that is half-published\n\t// (archives uploaded but checksums.txt not yet) fails before we eat the\n\t// archive's bandwidth.\n\ttimeout := updateDownloadTimeoutOrDefault(downloadTimeout)\n\tmanifestData, err := fetchURLBytes(manifestAsset.BrowserDownloadURL, timeout)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"download checksum manifest: %w\", err)\n\t}\n\texpectedSum, err := parseChecksumManifest(manifestData, assetName)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"parse checksum manifest: %w\", err)\n\t}\n\n\t// Buffer the archive into memory so we can verify the full SHA-256\n\t// before writing anything to disk. Release archives are ~10–30 MB; the\n\t// extraction code already buffers zip archives in full (random access\n\t// requirement), so this is not a new memory cost on Windows. For tar.gz\n\t// it adds a single in-RAM copy, which is preferable to running the\n\t// untrusted bytes through gzip+tar extraction before the SHA-256 check.\n\tarchiveData, err := fetchURLBytes(downloadURL, timeout)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"download failed: %w\", err)\n\t}\n\n\tif err := verifyAssetSHA256(archiveData, expectedSum, assetName); err != nil {\n\t\t// Do NOT extract or replace; the next poll tick will retry. A\n\t\t// corrupted asset is rare enough that retrying through the same\n\t\t// CDN is the right default; persistent failures will surface in\n\t\t// the daemon log.","sourceCodeStart":390,"sourceCodeEnd":426,"githubUrl":"https://github.com/multica-ai/multica/blob/2c0912b6ec764b373d44eeea1e80f0d9f11ab417/server/internal/cli/update.go#L390-L426","documentation":"parseChecksumManifest parses the GoReleaser checksums.txt looking for the line whose filename matches the release asset; failure is wrapped as 'parse checksum manifest: %w'. It fails when the manifest has no entry for the asset or the line format is not '<hex>  <filename>'.","triggerScenarios":"Asset names in the release changed (new GOOS/GOARCH naming, archive suffix change) so the manifest entry no longer matches what findReleaseAsset picked; checksums.txt hand-edited or generated by a different tool with another format; a manifest listing CRLF-separated lines a strict parser misses.","commonSituations":"A release pipeline change (GoReleaser config rename) applied to the archive name but not to the code's asset-candidate list, causing a name mismatch; building custom release artifacts with a non-GoReleaser checksum layout.","solutions":["Download checksums.txt from the release and confirm an exact line for the asset name (compare byte-for-byte, including .tar.gz vs .zip).","Align findReleaseAsset's candidate names with what GoReleaser actually publishes (check .goreleaser.yml archives.name_template).","If using a custom release process, emit checksums in the standard '<sha256>  <filename>' format with two spaces.","Re-release with a corrected manifest if the file itself is wrong."],"exampleFix":"null","handlingStrategy":"validation","validationCode":"// before updating, confirm the manifest has an entry for the asset you expect\nmanifest, _ := fetchURLBytes(manifestURL, timeout)\nif _, err := parseChecksumManifest(manifest, expectedAssetName); err != nil {\n    // release packaging mismatch: stop before downloading the archive\n}","typeGuard":null,"tryCatchPattern":"out, err := cli.UpdateViaDownload(ver)\nif err != nil && strings.HasPrefix(err.Error(), \"parse checksum manifest\") {\n    // asset naming drift: compare .goreleaser.yml name_template with the updater's candidates\n}","preventionTips":["Keep asset name templates and checksum manifest format consistent across releases","Test the updater against a draft release in CI before promoting","Use the standard GoReleaser checksums.txt format unchanged"],"tags":["checksum","parse","release","goreleaser"],"backgroundTag":null,"analyzedSha":"2c0912b6ec764b373d44eeea1e80f0d9f11ab417","analyzedAt":"2026-08-15T13:25:18.241Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}