{"record":{"id":"f154de69ddf5e8af","repo":"goreleaser/goreleaser","slug":"invalid-algorithm-s","errorCode":null,"errorMessage":"invalid algorithm: %s","messagePattern":"invalid algorithm: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/artifact/artifact.go","lineNumber":409,"sourceCode":"\t\th = sha256.New224()\n\tcase \"sha384\":\n\t\th = sha512.New384()\n\tcase \"sha256\":\n\t\th = sha256.New()\n\tcase \"sha1\":\n\t\th = sha1.New()\n\tcase \"sha512\":\n\t\th = sha512.New()\n\tcase \"sha3-224\":\n\t\th = hash.Hash(sha3.New224())\n\tcase \"sha3-384\":\n\t\th = hash.Hash(sha3.New384())\n\tcase \"sha3-256\":\n\t\th = hash.Hash(sha3.New256())\n\tcase \"sha3-512\":\n\t\th = hash.Hash(sha3.New512())\n\tdefault:\n\t\treturn \"\", fmt.Errorf(\"invalid algorithm: %s\", algorithm)\n\t}\n\n\tif _, err := io.Copy(h, file); err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to checksum: %w\", err)\n\t}\n\tcheck := hex.EncodeToString(h.Sum(nil))\n\tif a.Extra == nil {\n\t\ta.Extra = make(Extras)\n\t}\n\ta.Extra[ExtraChecksum] = fmt.Sprintf(\"%s:%s\", algorithm, check)\n\treturn check, nil\n}\n\nvar noRefresh = func() error { return nil }\n\n// Refresh executes a Refresh extra function on artifacts, if it exists.\nfunc (a Artifact) Refresh() error {\n\t// for now lets only do it for checksums, as we know for a fact that","sourceCodeStart":391,"sourceCodeEnd":427,"githubUrl":"https://github.com/goreleaser/goreleaser/blob/f5edd7395693c0c6b501dc722d445d2e86af854d/internal/artifact/artifact.go#L391-L427","documentation":"Artifact.Checksum validates the algorithm argument against a fixed switch (blake2b, blake2s, blake3, crc32, md5, sha1, sha256, sha512, sha3-224/256/384/512, etc.). Any unrecognized string falls into the default branch and returns 'invalid algorithm: %s'. This is a pure argument-validation error — no file I/O has happened beyond the open.","triggerScenarios":"Calling Checksum with a misspelled or unsupported algorithm name, e.g. 'SHA256' (uppercase, case-sensitive), 'sha-256' (hyphenated), 'sha224', or 'xxhash'; used by checksum publishers, uploadAsset, and refreshOne flows.","commonSituations":"Configuring a checksum/publisher stage with 'SHA-256' or 'sha-256' instead of 'sha256', assuming SHA-224 is supported, or passing user input straight through as the algorithm.","solutions":["Use one of the exact supported names, lowercase: sha256, sha512, sha1, md5, crc32, blake2s, blake2b, blake3, sha3-256, etc.","Replace hyphens/uppercase: 'SHA-256' -> 'sha256'.","Check the switch in internal/artifact/artifact.go for the definitive list of accepted algorithms.","If you need an unsupported algorithm, compute it yourself from the artifact file instead of via Checksum."],"exampleFix":"// before\nsum, err := art.Checksum(\"SHA-256\") // invalid algorithm: SHA-256\n// after\nsum, err := art.Checksum(\"sha256\")","handlingStrategy":"validation","validationCode":"var validAlgos = map[string]bool{\n    \"crc32\": true, \"md5\": true, \"sha1\": true, \"sha256\": true, \"sha512\": true,\n    \"sha3-224\": true, \"sha3-256\": true, \"sha3-384\": true, \"sha3-512\": true,\n    \"blake2s\": true, \"blake2b\": true, \"blake3\": true,\n}\nfunc checkAlgo(algo string) error {\n    if !validAlgos[algo] {\n        return fmt.Errorf(\"unsupported algorithm %q\", algo)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"sum, err := art.Checksum(algo)\nif err != nil {\n    if strings.HasPrefix(err.Error(), \"invalid algorithm\") {\n        return fmt.Errorf(\"use a lowercase supported name like sha256, got %q\", algo)\n    }\n    return err\n}","preventionTips":["Use exact lowercase algorithm names: 'sha256', never 'SHA-256' or 'SHA256'.","Keep a whitelist map of supported algorithms in your tooling.","Consult the switch in internal/artifact/artifact.go for the authoritative list.","Do not accept raw user input as the algorithm without validation."],"tags":["go","checksum","argument-validation","crypto"],"backgroundTag":"invalid-checksum-algorithm","analyzedSha":"f5edd7395693c0c6b501dc722d445d2e86af854d","analyzedAt":"2026-09-05T09:57:18.807Z","contentChangedAt":"2026-09-05T09:57:18.807Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}