can1357/oh-my-pi · error · Error

GitHub release asset ${binaryName} has an unsupported digest

Error message

GitHub release asset ${binaryName} has an unsupported digest

What it means

GitHub reports asset digests as `sha256:<64 hex chars>`. The updater parses this strict format and rejects any digest that is present but does not match — e.g. a different algorithm prefix, wrong length, or non-hex characters — because it cannot be used for the sha256 verification the installer performs.

Source

Thrown at packages/coding-agent/src/cli/update-cli.ts:229

	const matches = release.assets.filter(asset => isRecord(asset) && asset.name === binaryName);
	if (matches.length !== 1) {
		throw new Error(`GitHub release ${expectedTag} has ${matches.length} assets named ${binaryName}`);
	}

	const asset = matches[0];
	if (!isRecord(asset) || asset.state !== "uploaded") {
		throw new Error(`GitHub release asset ${binaryName} is not fully uploaded`);
	}
	if (typeof asset.size !== "number" || !Number.isSafeInteger(asset.size) || asset.size <= 0) {
		throw new Error(`GitHub release asset ${binaryName} has an invalid size`);
	}
	if (typeof asset.digest !== "string") {
		throw new Error(`GitHub release asset ${binaryName} has no digest`);
	}
	const digest = /^sha256:([0-9a-f]{64})$/i.exec(asset.digest)?.[1];
	if (!digest) {
		throw new Error(`GitHub release asset ${binaryName} has an unsupported digest`);
	}

	const expectedUrl = `https://github.com/${REPO}/releases/download/${expectedTag}/${binaryName}`;
	if (asset.browser_download_url !== expectedUrl) {
		throw new Error(`GitHub release asset ${binaryName} has an unexpected download URL`);
	}

	return {
		url: expectedUrl,
		size: asset.size,
		digest: `sha256:${digest.toLowerCase()}`,
	};
}

async function getReleaseBinaryAsset(
	expectedVersion: string,
	binaryName: string,
	fetchImpl: Fetch = fetch,

View on GitHub (pinned to 9690622007)

Solutions

Inspect the asset's digest field via the API; if it is genuinely non-sha256, GitHub's format changed — update the regex and digest handling in update-cli.ts.
Re-upload the asset so GitHub regenerates a standard sha256 digest.
Fix test stubs to use a valid "sha256:" + 64 hex chars value.
Ensure no proxy is rewriting the JSON body.

Example fix

// before (invalid stub digest)
digest: "md5:d41d8cd98f00b204e9800998ecf8427e"
// after
digest: "sha256:" + "b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9"

Defensive patterns

Strategy: type-guard

Validate before calling

const asset = release.assets?.find(a => a?.name === binaryName);
if (typeof asset?.digest === "string" && !/^sha256:[0-9a-f]{64}$/i.test(asset.digest)) {
  throw new Error(`Unsupported digest format: ${asset.digest}`);
}

Type guard

function hasSha256Digest(asset: unknown): asset is { digest: string } {
  return typeof (asset as { digest?: unknown })?.digest === "string"
    && /^sha256:[0-9a-f]{64}$/i.test((asset as { digest: string }).digest);
}

Try / catch

try {
  await update();
} catch (err) {
  if (err instanceof Error && err.message.includes("has an unsupported digest")) {
    console.error("Asset digest is not sha256:<64 hex>; GitHub format may have changed. Update the client.");
  } else throw err;
}

Prevention

Use strict regex validation on checksum strings before using them.
Watch GitHub changelogs for digest-format changes.
In test stubs, generate digests as "sha256:" + 64 hex chars.

When it happens

Trigger: resolveReleaseBinaryAsset throws when the regex `/^sha256:([0-9a-f]{64})$/i` fails to match the asset's digest string.

Common situations: GitHub changing or introducing a new digest algorithm prefix (e.g. sha512), locally re-uploaded assets carrying nonstandard digests, a stub/mocked digest like "abc" in tests, or a proxy corrupting the value.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/1d04466bca991957. Report an issue: GitHub.